[<prev] [next>] [day] [month] [year] [list]
Message-ID: <668237346.17178030.1554294590342.JavaMail.zimbra@redhat.com>
Date: Wed, 3 Apr 2019 08:29:50 -0400 (EDT)
From: Vladis Dronov <vdronov@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2019-3837: RHEL6: memory leak in tcp_recvmsg() with NET_DMA
Heololo,
It was found that the net_dma code in tcp_recvmsg() in the RHEL6 kernel is
thread-unsafe. So an unprivileged multi-threaded userspace application
calling recvmsg() for the same network socket in parallel executed on
ioatdma-enabled hardware with net_dma enabled can leak the memory,
crash the host leading to a denial-of-service, or cause a random memory
corruption.
This flaw was assigned an id of CVE-2019-3837.
net_dma was disabled in the upstream Linux kernel since v3.13-rc5 by
the 77873803363c "net_dma: mark broken" and then completely removed
by the 7bced397510a "net_dma: simple removal".
So this flaw affects RHEL-6 only and any (LTS) Linux kernel (of any
distribution) which has not backported the net_dma disabling commits
mentioned above.
Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security | Senior Software Engineer
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
