Bug 78363 – Memory leak through ip_options_get (CAN-2004-1335)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Thierry Carrez (RETIRED) 2005-01-17 07:03:30 UTC]

CAN-2004-1335
Memory leak in the ip_options_get function in the Linux kernel before 2.6.10 allows local users to cause a denial of service (memory consumption) by repeatedly calling the ip_cmsg_send function.

See URL for common patches with bug 78362 and bug 74392.

[Comment 1 solar (RETIRED) 2005-01-18 12:01:19 UTC]

I don't think the mails are going in the inboxes of the people on kern-sec@ for whatever reason. Or atleast when I just checked my inbox I see nothing.

[Comment 2 solar (RETIRED) 2005-01-18 12:03:38 UTC]

ignore last comment. They were in my spam folder for whatever reason.

[Comment 3 solar (RETIRED) 2005-01-18 15:55:11 UTC]

Tim/plasmaroo can you make heads/tails of exactly which patches need to be added to 2.4.x? he has 4 patches listed.

[Comment 4 Tim Yamin (RETIRED) 2005-01-19 07:52:04 UTC]

For this bug just the following changeset is needed (Should apply to 2.4 also):

http://linux.bkbits.net:8080/linux-2.6/gnupatch@41b76673BNGyitGqJmXlJzqgdV85yg

[Comment 5 Adam Mondl (RETIRED) 2005-01-21 19:12:24 UTC]

Fixed in ~x86 hardened-sources-2.4.28-r4

[Comment 6 solar (RETIRED) 2005-02-04 06:44:23 UTC]

Thanks tim grsec-sources patch in ~arch

[Comment 7 Thierry Carrez (RETIRED) 2005-03-16 03:16:27 UTC]

Mass-Ccing [e-mail] to make sure Kernel Security guys know about all
of these...

[Comment 8 Daniel Drake (RETIRED) 2005-03-16 05:42:42 UTC]

gentoo-dev-sources is unaffected

[Comment 9 Tim Yamin (RETIRED) 2005-03-29 06:12:54 UTC]

`Kumba: It seems mips-sources-2.4.27, 2.4.28, 2.6.8.1 and 2.6.9 still need this fix; anything >= 2.6.10 already includes it.

[Comment 10 Tim Yamin (RETIRED) 2005-04-07 05:20:10 UTC]

openmosix-sources also needs patching...

[Comment 11 Joshua Kinard 2005-04-23 22:30:51 UTC]

mips-sources fixed.

[Comment 12 Tim Yamin (RETIRED) 2005-08-15 15:36:44 UTC]

All fixed, closing bug.