oss-security - Re: CVE-2009-2903 kernel: appletalk: denial of service when handling IP tunnelled over DDP datagrams

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090914045744.GA28320@1wt.eu>
Date: Mon, 14 Sep 2009 06:57:44 +0200
From: Willy Tarreau <w@....eu>
To: Eugene Teo <eugeneteo@...nel.sg>
Cc: oss-security@...ts.openwall.com,
        "Steven M. Christey" <coley@...us.mitre.org>, Greg KH <gregkh@...e.de>
Subject: Re: CVE-2009-2903 kernel: appletalk: denial of service when handling IP tunnelled over DDP datagrams

Hi Eugene,

On Mon, Sep 14, 2009 at 08:57:02AM +0800, Eugene Teo wrote:
> The check for the ipddpN device in the handle_ip_over_ddp() function 
> returns -NODEV to the atalk_rcv() function when the device does not 
> exist. The atalk_rcv() function then directly returns that value to its 
> caller. There is a missing call to kfree_skb() in these unaccepted 
> IP-DDP datagram that can exhaust the kernel memory eventually. It 
> affects Linux hosts with appletalk and ipddp modules loaded, that are 
> attached to the same link. Thanks to Mark Smith for reporting this issue 
> to us.
>
> net-next-2.6 commit:
> http://git.kernel.org/?p=linux/kernel/git/davem/net-next-2.6.git;a=commit;h=ffcfb8db540ff879c2a85bf7e404954281443414 
> 
> 
> Possible mitigation method:
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2903#c3
> 
> Reference:
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2903
> http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=Documentation/networking/ipddp.txt;h=661a5558dd8e928f15771c07ef34b3ee9cb81e57;hb=HEAD
> 
> Greg, this should go to -stable.

Davem generally handles his own -stable queue for the net subsystem
and submits fixes himself, but that's nice to notify about upcoming
patches in case it gets missed !

> Willy, this affects upstream 2.4 I believe.

Indeed, it seems so. I'm queuing it up for next release. I will have
to review it since the changes are not obvious. If you're aware of
any reproducer, I'd be glad to get it (in private) ; I'd like to at
least ensure I don't break the driver while trying to fix it !

Thanks!
Willy

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.