oss-sec mailing list archives
Re: CVE-2009-2903 kernel: appletalk: denial of service when handling IP tunnelled over DDP datagrams
From: Willy Tarreau <w () 1wt eu>
Date: Mon, 14 Sep 2009 06:57:44 +0200
Hi Eugene, On Mon, Sep 14, 2009 at 08:57:02AM +0800, Eugene Teo wrote:
The check for the ipddpN device in the handle_ip_over_ddp() function returns -NODEV to the atalk_rcv() function when the device does not exist. The atalk_rcv() function then directly returns that value to its caller. There is a missing call to kfree_skb() in these unaccepted IP-DDP datagram that can exhaust the kernel memory eventually. It affects Linux hosts with appletalk and ipddp modules loaded, that are attached to the same link. Thanks to Mark Smith for reporting this issue to us. net-next-2.6 commit: http://git.kernel.org/?p=linux/kernel/git/davem/net-next-2.6.git;a=commit;h=ffcfb8db540ff879c2a85bf7e404954281443414 Possible mitigation method: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2903#c3 Reference: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2903 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=Documentation/networking/ipddp.txt;h=661a5558dd8e928f15771c07ef34b3ee9cb81e57;hb=HEAD Greg, this should go to -stable.
Davem generally handles his own -stable queue for the net subsystem and submits fixes himself, but that's nice to notify about upcoming patches in case it gets missed !
Willy, this affects upstream 2.4 I believe.
Indeed, it seems so. I'm queuing it up for next release. I will have to review it since the changes are not obvious. If you're aware of any reproducer, I'd be glad to get it (in private) ; I'd like to at least ensure I don't break the driver while trying to fix it ! Thanks! Willy
Current thread:
- CVE-2009-2903 kernel: appletalk: denial of service when handling IP tunnelled over DDP datagrams Eugene Teo (Sep 13)
- Re: CVE-2009-2903 kernel: appletalk: denial of service when handling IP tunnelled over DDP datagrams Willy Tarreau (Sep 13)
- Re: CVE-2009-2903 kernel: appletalk: denial of service when handling IP tunnelled over DDP datagrams Eugene Teo (Sep 16)