Bug 778460 (CVE-2012-3552) - VUL-1: CVE-2012-3552: kernel: net: slab corruption due to improper synchronization around inet->opt
Summary: VUL-1: CVE-2012-3552: kernel: net: slab corruption due to improper synchroniz...
Status: RESOLVED FIXED
Alias: CVE-2012-3552
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Jiri Bohac
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-09-03 06:16 UTC by Sebastian Krahmer
Modified: 2016-03-18 15:36 UTC (History)
6 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Krahmer 2012-09-03 06:16:31 UTC
Via OSS-sec:


Description of the problem:
Lack proper synchronization to manipulate inet->opt ip_options can lead
to system crash.

Problem is that ip_make_skb() calls ip_setup_cork() and ip_setup_cork()
possibly makes a copy of ipc->opt (struct ip_options), without any
protection against another thread manipulating inet->opt. Another thread
can change inet->opt pointer and free old one under us.

Given right server application (setting socket options and processing
traffic over the same socket at the same time), remote attacker could
use this flaw to crash the system. More likely though, local
unprivileged user could use this flaw to crash the system.

Upstream fix:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=f6d8bd051c391c1c0458a3
+0b2a7abcd939329259

Thanks,
--
Petr Matousek / Red Hat Security Response Team
Comment 1 Sebastian Krahmer 2012-09-03 06:19:27 UTC
CVE-2012-3552
Comment 2 Swamp Workflow Management 2012-09-03 22:00:11 UTC
bugbot adjusting priority
Comment 3 Marcus Meissner 2012-10-12 20:32:44 UTC
any evaluation here?

what versions does this affect?
Comment 5 Marcus Meissner 2012-10-25 15:26:16 UTC
Only SUSE Linux ENterprise 10 codebase is affected, newer versions are not.

Was fixed around 2.6.39 timeframe, so does not affect 3.0 and newer kernels.
Comment 6 Marcus Meissner 2013-02-06 17:14:49 UTC
(and SLE11 SP1 with 2.6.32 likely)
Comment 13 Jiri Bohac 2015-04-03 11:56:54 UTC
The fix breaks the KABI. Teradata kernels are the only kernels that require this fix.

Does Teradata prefer
1) not having this fixed at all
2) having this fixed at the expense of breaking the KABI?

As Petr says, the risk is low (local DoS).
Comment 14 Michal Hocko 2015-07-03 11:55:40 UTC
(In reply to Jiri Bohac from comment #13)
> The fix breaks the KABI. Teradata kernels are the only kernels that require
> this fix.
> 
> Does Teradata prefer
> 1) not having this fixed at all
> 2) having this fixed at the expense of breaking the KABI?
> 
> As Petr says, the risk is low (local DoS).

ping Roberto
Comment 15 Roberto Angelino 2015-07-27 16:09:19 UTC
(In reply to Michal Hocko from comment #14)
> (In reply to Jiri Bohac from comment #13)
> > The fix breaks the KABI. Teradata kernels are the only kernels that require
> > this fix.
> > 
> > Does Teradata prefer
> > 1) not having this fixed at all
> > 2) having this fixed at the expense of breaking the KABI?
> > 
> > As Petr says, the risk is low (local DoS).
> 
> ping Roberto

Michal,
   Yes.  Teradata would like this in TD kernel(s).
Comment 16 Michal Hocko 2015-08-25 10:18:15 UTC
(In reply to Roberto Angelino from comment #15)
> (In reply to Michal Hocko from comment #14)
> > (In reply to Jiri Bohac from comment #13)
> > > The fix breaks the KABI. Teradata kernels are the only kernels that require
> > > this fix.
> > > 
> > > Does Teradata prefer
> > > 1) not having this fixed at all
> > > 2) having this fixed at the expense of breaking the KABI?
> > > 
> > > As Petr says, the risk is low (local DoS).
> > 
> > ping Roberto
> 
> Michal,
>    Yes.  Teradata would like this in TD kernel(s).

Jiri, could you take care of this please?
Comment 18 Jiri Bohac 2015-11-13 19:36:17 UTC
Michal: the patch is in the v2.6.32.61 stable kernel, which applies cleanly to the SLE11-SP1-TD branch. I pushed a kernel with this patch to users/jbohac/SLE11-SP1-TD/for-next. As discussed earlier, the fix breaks the KABI, so it needs to be refreshed.

Do Teradata want this also in SLES10-SP3-TD? (2.6.32.y is the oldest -stable branch containing the fix, we would have to backport it to 2.6.16)
Comment 19 Michal Hocko 2015-11-16 12:17:51 UTC
(In reply to Jiri Bohac from comment #18)
> Michal: the patch is in the v2.6.32.61 stable kernel, which applies cleanly
> to the SLE11-SP1-TD branch. I pushed a kernel with this patch to
> users/jbohac/SLE11-SP1-TD/for-next. As discussed earlier, the fix breaks the
> KABI, so it needs to be refreshed.

Pulled, thanks! I have updated kabi metadata as well.
Comment 21 Marcus Meissner 2016-03-18 15:36:51 UTC
done i think