Bug 389152 (CVE-2008-2136) - VUL-0: CVE-2008-2136: kernel: remote dos fixed in 2.6.25.3
Summary: VUL-0: CVE-2008-2136: kernel: remote dos fixed in 2.6.25.3
Status: RESOLVED FIXED
Alias: CVE-2008-2136
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Critical
Target Milestone: ---
Deadline: 2008-06-09
Assignee: Marcus Meissner
QA Contact: Security Team bot
URL:
Whiteboard: wasL3:30853 kernel:10.2,10.3,sles10sp...
Keywords: DSLA_REQUIRED, DSLA_SOLUTION_PROVIDED
Depends on:
Blocks:
 
Reported: 2008-05-11 13:04 UTC by Marcus Meissner
Modified: 2018-10-03 07:52 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority: 800
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2008-05-11 13:04:16 UTC
Your friendly security team received the following report.
Please respond ASAP.
The issue is public.

Date: Sun, 11 May 2008 12:32:08 +0200
From: Andi Kleen <andi@firstfloor.org>
To: security-intern@suse.de
Subject: [sec-int] remote dos fixed in 2.6.25.3


Just in case you missed it the kfree_skb fix in 2.6.25.3 fixes a DoS
that allows everyone to fill all memory as soon as the ipv6 module is loaded
and SIT is not firewalled.  Should probably get kernel security updates at
high priority.

-Andi

Marcus says: gitlinks:
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a=commit;h=36ca34cc3b8335eb1fe8bd9a1d0a2592980c3f02

http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a=commitdiff;h=1be05a5eda841014c1151cb0f8dc791862bd40a5
Comment 1 Marcus Meissner 2008-05-11 13:09:33 UTC
code looks same down to SLES 9 .. so I guess all 2.6 are affected.

Also SLES8 _rcv function looks the same, so I guess also 2.4.


This is a SLES 8 patch candidate.

ccing reporter ;)
Comment 2 Greg Kroah-Hartman 2008-05-12 15:31:11 UTC
Karsten, can you do this for all kernel versions?
Comment 3 Greg Kroah-Hartman 2008-05-12 15:31:43 UTC
There is a CVE requested for this, but it is not assigned yet, should happen tomorrow.
Comment 4 Marcus Meissner 2008-05-12 20:04:06 UTC
CVE-2008-2136
Comment 6 Karsten Keil 2008-05-13 12:32:42 UTC
Greg, should I fix this for head too, or will we go to 2.6.25.3 soon ?
Comment 7 Karsten Keil 2008-05-13 13:31:43 UTC
Did submit to kernel CVS:
SLES8
SLES9 SP3,SP4
SLES10 SP1,SP2 (SP2 disabled with +post-sp2)
SL102
SL103
Comment 8 Greg Kroah-Hartman 2008-05-13 15:38:18 UTC
(In reply to comment #6 from Karsten Keil)
> Greg, should I fix this for head too, or will we go to 2.6.25.3 soon ?
> 

We have already moved to 2.6.25.3 in HEAD, so it is fixed there already.
Comment 9 Karsten Keil 2008-05-13 17:25:48 UTC
Argh, I didn't saw that cvs up did fail (temporary problem on my side), sorry for the noise.
Comment 11 Andi N Kleen 2008-06-06 18:34:38 UTC
So what's the state of this now? 

I cannot really believe that a ping of death type problem takes that long to fix.
Would the release process go faster if I posted a exploit publicly?
Comment 12 Marcus Meissner 2008-06-06 21:36:09 UTC
no, it would not go faster, it would just increase my stress levels.

But feel free to do anyway. :)

A kernel update is in the making already, just no one seems to want to hurry.
Comment 13 Marcus Meissner 2008-06-06 22:12:48 UTC
Karsten, I do not see it in the SL103 branch. DId you really commit it there?


it is in SL102, SLES10SP1, SLES10SP2 (this one is already released), 
SLES9SP4 and SLES8.

=> Only in SL103 missing.
Comment 14 Karsten Keil 2008-06-09 11:47:49 UTC
Done, seems the local cvs issue from comment #9 also did not commit the changes to the main rep., they already were in my tree, sorry for the delay.
Comment 15 Marcus Meissner 2008-06-16 07:50:36 UTC
all done for kernel -> fixed
Comment 16 Marcus Meissner 2008-06-19 12:21:27 UTC
10.2 and 10.3 kernel updates released
Comment 17 Marcus Meissner 2008-06-24 09:52:49 UTC
released sles9 updates kernel version is: 2.6.5-7.312
Comment 18 Marcus Meissner 2008-07-23 10:01:10 UTC
This bug was mentioned / fixed in the SLERT 10 SP2 kernel, version 2.6.22.19-0.15, released Wed 23 July 2008.