oss-security - Re: CVE-2009-2903 kernel: appletalk: denial of service when handling IP tunnelled over DDP datagrams

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 17 Sep 2009 15:03:40 +0800
From: Eugene Teo <eugene@...hat.com>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>, Willy Tarreau <w@....eu>
Subject: Re: CVE-2009-2903 kernel: appletalk: denial of service
 when handling IP tunnelled over DDP datagrams

Eugene Teo wrote:
> Eugene Teo wrote:
>> The check for the ipddpN device in the handle_ip_over_ddp() function 
>> returns -NODEV to the atalk_rcv() function when the device does not 
>> exist. The atalk_rcv() function then directly returns that value to 
>> its caller. There is a missing call to kfree_skb() in these unaccepted 
>> IP-DDP datagram that can exhaust the kernel memory eventually. It 
>> affects Linux hosts with appletalk and ipddp modules loaded, that are 
>> attached to the same link. Thanks to Mark Smith for reporting this 
>> issue to us.
> 
> Some updates and a quick analysis at: 
> https://bugzilla.redhat.com/CVE-2009-2903#c0 and 
> http://kbase.redhat.com/faq/docs/DOC-19069

Should be http://kbase.redhat.com/faq/docs/DOC-19077.

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.