oss-sec mailing list archives
CVE-2019-3837: RHEL6: memory leak in tcp_recvmsg() with NET_DMA
From: Vladis Dronov <vdronov () redhat com>
Date: Wed, 3 Apr 2019 08:29:50 -0400 (EDT)
Heololo, It was found that the net_dma code in tcp_recvmsg() in the RHEL6 kernel is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service, or cause a random memory corruption. This flaw was assigned an id of CVE-2019-3837. net_dma was disabled in the upstream Linux kernel since v3.13-rc5 by the 77873803363c "net_dma: mark broken" and then completely removed by the 7bced397510a "net_dma: simple removal". So this flaw affects RHEL-6 only and any (LTS) Linux kernel (of any distribution) which has not backported the net_dma disabling commits mentioned above. Best regards, Vladis Dronov | Red Hat, Inc. | Product Security | Senior Software Engineer
Current thread:
- CVE-2019-3837: RHEL6: memory leak in tcp_recvmsg() with NET_DMA Vladis Dronov (Apr 03)