netdev - Re: [patch 0/8 2.6.32] CVE-2010-4251: packet backlog can get too large

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1321226949.3059.13.camel@deadeye>
Date:	Sun, 13 Nov 2011 23:29:09 +0000
From:	Ben Hutchings <ben@...adent.org.uk>
To:	David Miller <davem@...emloft.net>
Cc:	dan.carpenter@...cle.com, stable@...r.kernel.org, greg@...ah.com,
	netdev@...r.kernel.org, yi.zhu@...el.com, eric.dumazet@...il.com
Subject: Re: [patch 0/8 2.6.32] CVE-2010-4251: packet backlog can get too
 large

On Sun, 2011-11-13 at 15:58 -0500, David Miller wrote:
> From: Dan Carpenter <dan.carpenter@...cle.com>
> Date: Sun, 13 Nov 2011 23:13:36 +0300
> 
> > This patch series is to address CVE-2010-4251 for the 2.6.32 stable
> > kernel.  Here is the CVE summary:
> > 
> >  "The socket implementation in net/core/sock.c in the Linux kernel
> >   before 2.6.34 does not properly manage a backlog of received
> >   packets, which allows remote attackers to cause a denial of service
> >   (memory consumption) by sending a large amount of network traffic,
> >   as demonstrated by netperf UDP tests."
> > 
> > [patch 1/8] introduces sk_add_backlog_limited()
> > [patch 2-7/8] change each network protocol to use sk_add_backlog_limited()
> > 	where appropriate.
> > [patch 8/8] renames sk_add_backlog() to __sk_add_backlog() and
> > 	sk_add_backlog_limited() to sk_add_backlog().
> > 
> > The patches mostly apply without changes.  The exception is:
> > [patch 2/8] udp: use limited socket backlog
> > Then the rename [patch 8/8] needed to be changed as well to match.
> 
> These changes are way too intrusive and potentially regression
> inducing for -stable inclusion, especially a kernel that is in such
> deep maintainence mode as 2.6.32 is.

Debian 6.0 based on Linux 2.6.32 has patches #1-7, except our backport
of #2 (for udp) looks a bit different.

Apparently several other distributions have also applied these.

> Also, I tend to personally submit networking -stable patches, so please
> do not bypass me in this manner and instead recommend such submissions
> on the netdev list so I can evaluate the request.

But you've previously said that you are not submitting networking
patches to the longterm series.  Did you change your mind?

Ben.

-- 
Ben Hutchings
Never attribute to conspiracy what can adequately be explained by stupidity.

Download attachment "signature.asc" of type "application/pgp-signature" (829 bytes)