Bug 284894 (CVE-2009-2903)

Summary:	Kernel: appletalk IP-over-DDP DoS (CVE-2009-2903)
Product:	Gentoo Security	Reporter:	Alex Legler (RETIRED) <a3li>
Component:	Kernel	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	hardened-kernel+disabled, kernel
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://git.kernel.org/?p=linux/kernel/git/davem/net-next-2.6.git;a=commit;h=ffcfb8db540ff879c2a85bf7e404954281443414
Whiteboard:	[linux <2.6.31]
Package list:		Runtime testing required:	---

Description Alex Legler (RETIRED) archtester

2009-09-14 10:42:16 UTC

From Eugene Teo:
The check for the ipddpN device in the handle_ip_over_ddp() function 
returns -NODEV to the atalk_rcv() function when the device does not 
exist. The atalk_rcv() function then directly returns that value to its 
caller. There is a missing call to kfree_skb() in these unaccepted 
IP-DDP datagram that can exhaust the kernel memory eventually. It 
affects Linux hosts with appletalk and ipddp modules loaded, that are 
attached to the same link. Thanks to Mark Smith for reporting this issue 
to us.

Comment 1 Alex Legler (RETIRED) archtester

2009-09-16 09:45:29 UTC

CVE-2009-2903 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2903):
  Memory leak in the appletalk subsystem in the Linux kernel 2.4.x
  through 2.4.37.6 and 2.6.x through 2.6.31, when the appletalk and
  ipddp modules are loaded but the ipddp"N" device is not found, allows
  remote attackers to cause a denial of service (memory consumption)
  via IP-DDP datagrams.