Bug 505666 (CVE-2014-0100)

Summary:	Kernel: net: inet frag code race condition leading to user-after-free (CVE-2014-0100)
Product:	Gentoo Security	Reporter:	Agostino Sarubbo <ago>
Component:	Kernel	Assignee:	Gentoo Kernel Security <security-kernel>
Status:	RESOLVED FIXED
Severity:	normal	CC:	kernel
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Agostino Sarubbo gentoo-dev

2014-03-25 11:59:56 UTC

CVE-2014-0100 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0100):

Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel through 
3.13.6 allows remote attackers to cause a denial of service (use-after-free error) or possibly have 
unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a 
heavy CPU load.

Comment 1 GLSAMaker/CVETool Bot gentoo-dev

2014-08-10 22:04:28 UTC

CVE-2014-0100 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0100):
  Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c
  in the Linux kernel through 3.13.6 allows remote attackers to cause a denial
  of service (use-after-free error) or possibly have unspecified other impact
  via a large series of fragmented ICMP Echo Request packets to a system with
  a heavy CPU load.

Comment 2 John Helmert III archtester

2022-03-25 19:45:36 UTC

Fixed in 3.14 onwards as 3ef0eb0db4bf