Re: CVE request: Kernel: ping: NULL pointer dereference on write to msg_name

[Vasily Kulikov <segoon () openwall com>]

Hi,

On Fri, Dec 06, 2013 at 19:13 +0530, P J P wrote:
> Linux kernel built with the TCP/IP networking support(CONFIG_NET) is
> vulnerable to a NULL pointer dereference flaw. It could occur via a
> plain read(2) call on a ping socket. Usage of ping sockets is
> generally restricted to privileged users.
>
> A user/program able to read from ping sockets could use this flaw to crash a
> system resulting in DoS.
>
> Upstream fix:
> -------------
>  -> https://git.kernel.org/linus/cf970c002d270c36202bd5b9c2804d3097a52da0
>
> Reference:
> ----------
>  -> https://bugzilla.redhat.com/show_bug.cgi?id=1039046

The bug was introduced with ping6 sockets implementation in:

https://git.kernel.org/linus/6d0bfe22611602f36617bc7aa2ffa1bbb2f54c67

Thanks,

-- 
Vasily Kulikov
http://www.openwall.com - bringing security into open computing environments