Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 10 Jun 2009 13:32:45 +0800
From: Eugene Teo <>
CC: "Steven M. Christey" <>
Subject: CVE-2009-1389 kernel: r8169: fix crash when large packets are received

"Michael Tokarev reported receiving a large packet could crash a machine 
with RTL8169 NIC. Problem is this driver tells that NIC frames up to 
16383 bytes can be received but provides skb to rx ring allocated with 
smaller sizes (1536 bytes in case standard 1500 bytes MTU is used). When 
a frame larger than what was allocated by driver is received, dma 
transfer can occurs past the end of buffer and corrupt kernel memory.

Fix is to tell to NIC what is the maximum size a frame can be. This bug 
is very old, (before git introduction, linux-2.6.10)."

I have informed Willy (2.4 maintainer) about this.

Upstream 2.6 commit: 


Thanks, Eugene

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.