121890 2006-02-06 14:55 0000 [ICMP]: Fix extra dst release when ip_options_echo fails (CVE-2006-0454) 2009-05-03 16:02:17 0000 1 1 1 Unclassified Gentoo Security Kernel unspecified All Linux RESOLVED FIXED http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff_plain;h=fa60cf7f64a00c16e95717e8dccdb128877e342a;hp=5b7b644ca9a12396a46fad825a973fb8bed17102 [linux < 2.6.15.3] P1 critical --- 1 jaervosz@gentoo.org security@gentoo.org gimli@gentoo.org johnm@gentoo.org kang@gentoo.org kerframil@gmail.com kern-sec@gentoo.org kumba@gentoo.org marineam@gentoo.org moixa@gmx.ch wolf31o2@gentoo.org jaervosz@gentoo.org 2006-02-06 14:55:04 0000 When two ip_route_output_key lookups in icmp_send were combined I forgot to change the error path for ip_options_echo to not drop the dst reference since it now sits before the dst lookup. To fix it we simply jump past the ip_rt_put call. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> jaervosz@gentoo.org 2006-02-06 22:57:53 0000 Fixed in 2.6.15.3 jaervosz@gentoo.org 2006-02-06 22:58:58 0000 And vulnerable since: http://kernel.org/git/?p=linux/kernel/git/torvalds/old-2.6-bkcvs.git;a=commitdiff;h=10e52f732b932a46afe4e8562319df440f680713 moixa@gmx.ch 2006-02-07 01:48:24 0000 *** Bug 121945 has been marked as a duplicate of this bug. *** koon@gentoo.org 2006-02-07 10:57:22 0000 ccing kern-sec... jaervosz@gentoo.org 2006-02-07 11:36:46 0000 More info here: http://kernelslacker.livejournal.com/35361.html gpel@mpex.net 2006-02-07 11:49:33 0000 Sources above and code review show this concerns 2.6.12+ but not earlier and not 2.4 either. Maintainer may want to change Satus Whiteboard to reflect 2.6.12+ henrik@brixandersen.dk 2006-02-07 14:12:58 0000 FYI: I've just added sys-kernel/vanilla-sources-2.6.15.3 to the tree. plasmaroo@gentoo.org 2006-02-14 09:42:39 0000 CCing maintainers: ck-sources-2.6 -- marineam hardened-sources-2.6 -- johnm, hardened, kerframil hppa-sources-2.6 -- GMSoft mips-sources-2.6 -- `Kumba rsbac-sources-2.6 -- kang suspend2-sources-2.6 -- brix usermode-sources-2.6 -- dsd xbox-sources-2.6 -- gimli henrik@brixandersen.dk 2006-02-14 10:17:20 0000 Fixed in sys-kernel/suspend2-sources-2.6.15-r6. gmsoft@gentoo.org 2006-02-16 00:14:20 0000 hppa-source-2.6.15.4_p4 stable on hppa. Enjoy. dsd@gentoo.org 2006-03-02 05:14:11 0000 Fixed in usermode-sources-2.6.15-r1 kerframil@gmail.com 2006-03-16 04:37:13 0000 Now fixed in: * genpatches-2.6.14-11 * hardened-sources-2.6.14-r6 plasmaroo@gentoo.org 2006-04-20 10:57:02 0000 All fixed now, thanks!