| Summary: | Kernel : oops from tcp_collapse() when using splice(2) (CVE-2013-2128) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Kernel | Assignee: | Gentoo Kernel Security <security-kernel> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | kernel |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://bugzilla.redhat.com/show_bug.cgi?id=968484 | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
CVE-2013-2128 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2128): The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local users to cause a denial of service (system crash) via a crafted splice system call for a TCP socket. In 2.6.34 onwards |
From ${URL} : Linux kernel which supports splice(2) call to move data across file/socket descriptors via a pipe buffers, is vulnerable to a kernel crash that occurs while calling splice(2) over a tcp socket which in turn calls tcp_read_sock(). A user/program could use this flaw to cause system crash, resulting in DoS. Upstream fix: ------------- -> https://git.kernel.org/linus/baff42ab1494528907bf4d5870359e31711746ae