Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 6 Dec 2013 18:01:53 +0400
From: Vasily Kulikov <segoon@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: Kernel: ping: NULL pointer
 dereference on write to msg_name

Hi,

On Fri, Dec 06, 2013 at 19:13 +0530, P J P wrote:
> Linux kernel built with the TCP/IP networking support(CONFIG_NET) is
> vulnerable to a NULL pointer dereference flaw. It could occur via a
> plain read(2) call on a ping socket. Usage of ping sockets is
> generally restricted to privileged users.
> 
> A user/program able to read from ping sockets could use this flaw to crash a
> system resulting in DoS.
> 
> Upstream fix:
> -------------
>  -> https://git.kernel.org/linus/cf970c002d270c36202bd5b9c2804d3097a52da0
> 
> Reference:
> ----------
>  -> https://bugzilla.redhat.com/show_bug.cgi?id=1039046

The bug was introduced with ping6 sockets implementation in:

https://git.kernel.org/linus/6d0bfe22611602f36617bc7aa2ffa1bbb2f54c67

Thanks,

-- 
Vasily Kulikov
http://www.openwall.com - bringing security into open computing environments

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.