Bug 854175 (CVE-2013-6432) - VUL-1: CVE-2013-6432: kernel: ping: NULL pointer dereference on write to msg_name
Summary: VUL-1: CVE-2013-6432: kernel: ping: NULL pointer dereference on write to msg_...
Status: RESOLVED FIXED
Alias: CVE-2013-6432
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Borislav Petkov
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-12-06 15:51 UTC by Alexander Bergmann
Modified: 2014-02-25 11:54 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2013-12-06 15:51:38 UTC 
Public via oss-security:

P J P <ppandit@...>
2013-12-06 13:43:32 GMT

Linux kernel built with the TCP/IP networking support(CONFIG_NET) is 
vulnerable to a NULL pointer dereference flaw. It could occur via a plain 
read(2) call on a ping socket. Usage of ping sockets is generally restricted 
to privileged users.

A user/program able to read from ping sockets could use this flaw to crash a
system resulting in DoS.

Upstream fix:
-------------
  -> https://git.kernel.org/linus/cf970c002d270c36202bd5b9c2804d3097a52da0


References:
https://bugzilla.redhat.com/show_bug.cgi?id=1039046
http://comments.gmane.org/gmane.comp.security.oss.general/11623
Comment 1 Swamp Workflow Management 2013-12-08 23:00:11 UTC 
bugbot adjusting priority
Comment 3 Marcus Meissner 2013-12-10 08:10:51 UTC 
CVE-2013-6432
Comment 5 Borislav Petkov 2014-01-10 16:24:06 UTC 
SLE11-SP2/3: N/A.
SLE12: has it.
oS12.2: will get it through stable - assigning to me to verify.
oS12.3: N/A.
oS13.1: applied.
Comment 7 Swamp Workflow Management 2014-02-06 18:28:01 UTC 
openSUSE-SU-2014:0205-1: An update that solves 8 vulnerabilities and has 13 fixes is now available.

Category: security (important)
Bug References: 733022,773058,838024,844513,845621,846529,848042,849021,850072,852652,852656,852931,853050,853051,853052,853053,854175,854722,856294,859804,860993
CVE References: CVE-2013-4511,CVE-2013-4563,CVE-2013-4587,CVE-2013-6367,CVE-2013-6368,CVE-2013-6376,CVE-2013-6432,CVE-2014-0038
Sources used:
openSUSE 13.1 (src):    kernel-docs-3.11.10-7.3, kernel-source-3.11.10-7.1, kernel-syms-3.11.10-7.1
Comment 8 Borislav Petkov 2014-02-25 11:54:15 UTC 
Ok, so the bug was actually added by 6d0bfe22611602f36617bc7aa2ffa1bbb2f54c67 which came in in 3.11 AFAICT. oS12.2 does not apply for two reasons: it is 3.4-based and it has reached EOL anyway. Closing.