Bug 822583 (CVE-2013-2128) - VUL-0: kernel: CVE-2013-2128: oops from tcp_collapse() when using splice(2)
Summary: VUL-0: kernel: CVE-2013-2128: oops from tcp_collapse() when using splice(2)
Status: RESOLVED UPSTREAM
Alias: CVE-2013-2128
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: E-mail List
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-05-31 09:00 UTC by Alexander Bergmann
Modified: 2013-05-31 12:23 UTC (History)
2 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2013-05-31 09:00:37 UTC 
Public via oss-security.

Date: Thu, 30 May 2013 00:40:49 +0530 (IST)
From: P J P
Subject: [oss-security] CVE request: Linux kernel: net: oops from tcp_collapse() when using splice(2)

    Hello,

Linux kernel which supports splice(2) call to move data across file/socket
descriptors via a pipe buffers, is vulnerable to a kernel crash that occurs
while calling splice(2) over a tcp socket which in turn calls tcp_read_sock().

A user/program could use this flaw to cause system crash, resulting in DoS.

Upstream fix:
-------------
   -> https://git.kernel.org/linus/baff42ab1494528907bf4d5870359e31711746ae

Thank you.
--
Prasad J Pandit / Red Hat Security Response Team
DB7A 84C5 D3F9 7CD1 B5EB  C939 D048 7860 3655 602B
Comment 1 Michal Hocko 2013-05-31 11:36:03 UTC 
According to jbohac:
"splice, where the socket is unlocked and locked again, only came in 2.6.25"

So it seems that only SLE11-SP1 one is affected. But that tree already has the fix from the stable update (patches.kernel.org/patch-2.6.32.22-23). So there is nothing to do here I guess.
Comment 2 Marcus Meissner 2013-05-31 12:23:36 UTC 
Confirmed also that SLES 11 SP2 already has the good fix included (via 3.0 or earlier).

So no products affected, was fixed upstream in time. :)