oss-security - CVE request: kernel: DCCP invalid options

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sun, 8 May 2011 14:54:51 -0400
From: Dan Rosenberg <dan.j.rosenberg@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: kernel: DCCP invalid options

On a providing a bad option length for certain DCCP options, a remote
host may cause parsing to read beyond the bounds of the incoming
packet.  This may possibly cause a DoS by reading unmapped memory (if
you're unlucky), or it may allow an attacker to infer the contents of
kernel heap memory based on the parser's response.

-Dan

[1] http://marc.info/?l=linux-kernel&m=130468845209036&w=2

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.