oss-security - CVE-2009-2903 kernel: appletalk: denial of service when handling IP tunnelled over DDP datagrams

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4AAD94DE.9030407@kernel.sg>
Date: Mon, 14 Sep 2009 08:57:02 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>, Greg KH <gregkh@...e.de>,
        Willy Tarreau <w@....eu>
Subject: CVE-2009-2903 kernel: appletalk: denial of service when handling
 IP tunnelled over DDP datagrams

The check for the ipddpN device in the handle_ip_over_ddp() function 
returns -NODEV to the atalk_rcv() function when the device does not 
exist. The atalk_rcv() function then directly returns that value to its 
caller. There is a missing call to kfree_skb() in these unaccepted 
IP-DDP datagram that can exhaust the kernel memory eventually. It 
affects Linux hosts with appletalk and ipddp modules loaded, that are 
attached to the same link. Thanks to Mark Smith for reporting this issue 
to us.

net-next-2.6 commit:
http://git.kernel.org/?p=linux/kernel/git/davem/net-next-2.6.git;a=commit;h=ffcfb8db540ff879c2a85bf7e404954281443414 

Possible mitigation method:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2903#c3

Reference:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2903
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=Documentation/networking/ipddp.txt;h=661a5558dd8e928f15771c07ef34b3ee9cb81e57;hb=HEAD

Greg, this should go to -stable.

Willy, this affects upstream 2.4 I believe.

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.