oss-security - Re: CVE-2009-2698 kernel: udp socket NULL ptr dereference

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sun, 30 Aug 2009 19:15:34 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
CC: Greg KH <gregkh@...e.de>
Subject: Re: CVE-2009-2698 kernel: udp socket NULL ptr dereference

Eugene Teo wrote:
> A flaw was found in the udp_sendmsg() implementation in the Linux kernel 
> when using the MSG_MORE flag on UDP sockets. A local, unprivileged user 
> could use this flaw to cause a local denial of service or escalate their 
> privileges. This was fixed by Herbert Xu in v2.6.19-rc1, and reported by 
> Tavis Ormandy and Julien Tinnes of the Google Security Team.
> 
> Upstream commits:
> http://git.kernel.org/linus/1e0c14f49d6b393179f423abbac47f85618d3d46
> 
> References:
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2698
> https://rhn.redhat.com/errata/RHSA-2009-1222.html
> https://rhn.redhat.com/errata/RHSA-2009-1223.html

Related to this:
Add a check in ip_append_data() for NULL *rtp to prevent future bugs in 
callers from being exploitable.
http://git.kernel.org/linus/788d908f2879a17e5f80924f3da2e23f1034482d

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.