oss-security - Fwd: CVE-2008-5079: multiple listen()s on same socket corrupts the vcc table

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [month] [year] [list]

Date: Sat, 6 Dec 2008 10:16:12 +0800
From: "Eugene Teo" <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
Subject: Fwd: CVE-2008-5079: multiple listen()s on same socket corrupts the vcc table

Take note of this bug. You can find out more at:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-5079

Thanks, Eugene

---------- Forwarded message ----------
From: Hugo Dias <hdias@...chlabs.com>
Date: Fri, Dec 5, 2008 at 10:06 AM
Subject: CVE-2008-5079: multiple listen()s on same socket corrupts the vcc table
To: bugtraq@...urityfocus.com, vuln@...unia.com, ssynchron@...il.com


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2008-5079: multiple listen()s on same socket corrupts the vcc table

Release Date: 2008/12/05

I. Impact

Local Denial of Service on Linux kernel 2.6.x


II. Description

A vulnerabilty exists in Linux Kernel which can be exploited
by malicious users to cause a Denial of Service.

It seems that calling the svc_listen function in 'net/atm/svc.c'
twice on same socket, will create unassigned PVC/SVC entries,
despite returning EUNATCH.

This entries are visible using proc filesystem.

#cat /proc/net/atm/vc

Address  Itf ...
c7f34400 Unassigned   ...
c7f34400 Unassigned   ...
c7f34400 Unassigned   ...
.......

The code in 'net/atm/proc.c', responsible for displaying this info,
can't handle the unassigned entries. Kernel will freeze with
infinite loop in 'proc.c' if we cat '/proc/net/atm/pvc'  :


net/atm/proc.c:

074 static inline int compare_family(struct sock *sk, int family)
073 {
074         return !family || (sk->sk_family == family);
075 }

091 try_again:
092         for (; sk; sk = sk_next(sk)) {
093                 l -= compare_family(sk, family); <<<<<<<<<
094                 if (l < 0)
095                         goto out;
096         }


IV. Patch

http://marc.info/?l=linux-netdev&m=122841256115780&w=2

V. Credit

Hugo Dias - hdias [at] synchlabs [dot] com


VI. History

2008/11/14 - Vulnerability Discovered
2008/11/28 - Reported to vendor
2008/12/05 - Vendor Released Patch
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.10-svn4870 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkk4jIoACgkQE8nuJSQgUf2IawCgm6bdEkoj5DCGJPIXOob60nSM
lTwAnRtJCDPW4d4FE7F6KpzKw46EqO7d
=9Qis
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.