Bug 827565 (CVE-2013-2224) - VUL-1: CVE-2013-2224: kernel: 2.6.32+ IP_RETOPTS Buffer Poisoning DoS
Summary: VUL-1: CVE-2013-2224: kernel: 2.6.32+ IP_RETOPTS Buffer Poisoning DoS
Status: RESOLVED INVALID
Alias: CVE-2013-2224
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Jiri Bohac
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-07-01 08:42 UTC by Sebastian Krahmer
Modified: 2014-03-27 17:14 UTC (History)
5 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Krahmer 2013-07-01 08:42:53 UTC 
Via OSS-sec:

Date: Sun, 30 Jun 2013 00:33:47 -0700
From: Steven Ciaburri
To: oss-security

There is a local DOS exploit in centos 6, openvz 6, cloudlinux 6 and others.

https://www.rack911.com/poc/hemlock.c
Comment 1 Sebastian Krahmer 2013-07-01 08:44:33 UTC 
CVE-2013-2224
Comment 2 Sebastian Krahmer 2013-07-01 08:47:50 UTC 
According to sources, the RH bz ID seems to be 979788
Comment 3 Swamp Workflow Management 2013-07-01 22:00:11 UTC 
bugbot adjusting priority
Comment 4 Sebastian Krahmer 2013-07-02 11:15:35 UTC 
Also via OSS-sec:

Just to make sure -- this triggers Red Hat specific bug introduced via
CVE-2012-3552 fix [1, 2]. This issue does not affect upstream.

  [1] https://bugzilla.redhat.com/show_bug.cgi?id=979936#c2
  [2] https://bugzilla.redhat.com/show_bug.cgi?id=979936#c3

Spender suggest there is a integer problem in the code [3], but there is
not. The problem spender is trying to fix is avoided by the CMSG_OK
check in ip_cmsg_send() function and msg_controllen check in
__sys_sendmsg().

There is some slight room for error though since CMSG_OK checks for
"(cmsg)->cmsg_len >= sizeof(struct cmsghdr)" and the expression is
"err = cmsg->cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr));" but with
the current alignment and cmsghdr struct size we should be fine on
both 32 and 64bit.

  [3] https://twitter.com/grsecurity/status/351664130031222784

--
Petr Matousek / Red Hat Security Response Team
Comment 5 Sebastian Krahmer 2013-07-02 11:15:50 UTC 
So, can be closed then I guess?
Comment 6 Marcus Meissner 2013-07-02 13:21:34 UTC 
We might get this backport for/via bug 778460 too, but that one is not fixed yet either, so I would say also assign to Jiri.
Comment 7 Marcus Meissner 2013-10-04 16:42:11 UTC 
jiri?
Comment 8 Marcus Meissner 2014-03-18 09:33:52 UTC 
ping?
Comment 9 Jiri Bohac 2014-03-27 17:14:22 UTC 
Yes, this is indeed RH specific.
I still don't have a fix for bnc#778460 (SLE10 only) but I'll work on it ASAP.
I won't be reusing the RH patch (I don't even have access to it, they don't have it in their bugzilla), so there is no chance to introduce this bug.