Re: CVE request: kernel: ipv6: null pointer dereference in __inet6_check_established()

[Eugene Teo <eugene () redhat com>]

Eugene Teo wrote:
> According to the upstream commit 3f53a381, "we already have a valid net
> in that place, but... the tw pointer can be NULL there sometimes, thus
> causing an oops in NET_NS=y case.
>
> The same place in ipv4 code already works correctly using existing
> net, rather than tw's one."
>
> The bug exists since 2.6.27.
>
> http://git.kernel.org/linus/3f53a38131a4e7a053c0aa060aba0411242fb6b9

This was assigned with CVE-2009-1360.

Somehow http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1360
missed this reference even though this email was posted before
xorl.wordpress.com wrote about it.

Thanks, Eugene