[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4AB1CBEE.7020703@kernel.sg>
Date: Thu, 17 Sep 2009 13:41:02 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>, Willy Tarreau <w@....eu>
Subject: Re: CVE-2009-2903 kernel: appletalk: denial of service
when handling IP tunnelled over DDP datagrams
Eugene Teo wrote:
> The check for the ipddpN device in the handle_ip_over_ddp() function
> returns -NODEV to the atalk_rcv() function when the device does not
> exist. The atalk_rcv() function then directly returns that value to its
> caller. There is a missing call to kfree_skb() in these unaccepted
> IP-DDP datagram that can exhaust the kernel memory eventually. It
> affects Linux hosts with appletalk and ipddp modules loaded, that are
> attached to the same link. Thanks to Mark Smith for reporting this issue
> to us.
Some updates and a quick analysis at:
https://bugzilla.redhat.com/CVE-2009-2903#c0 and
http://kbase.redhat.com/faq/docs/DOC-19069
Thanks, Eugene
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
