Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 477464 (CVE-2013-4125) - Kernel : ipv6: BUG_ON in fib6_add_rt2node() (CVE-2013-4125)
Summary: Kernel : ipv6: BUG_ON in fib6_add_rt2node() (CVE-2013-4125)
Alias: CVE-2013-4125
Product: Gentoo Security
Classification: Unclassified
Component: Kernel (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Kernel Security
Depends on:
Reported: 2013-07-20 08:24 UTC by Agostino Sarubbo
Modified: 2022-03-25 15:26 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2013-07-20 08:24:35 UTC
From ${URL} :

If two router advertisment speaker announce seperate default gateways
with infinite timeout the kernel currently packs these routes together
into an ecmp route set. If one of the RA speaker now changes the
advertised expiration to a lower value and a third route with infinite
timeout pops up we end up with a BUG_ON.

Remote attacker could use this flaw to crash the system.

Fixed by:

Introduced by:

Introduced in upstream version:
Comment 1 Tom Wijsman (TomWij) (RETIRED) gentoo-dev 2013-07-20 17:48:35 UTC
r2443 | tomwij | 2013-07-20 19:48:05 +0200 (Sat, 20 Jul 2013) | 1 line

Commit security fixes for CVE-2013-4125 (fixes bug #477464), CVE-2013-4127 (fixes bug #477466) and CVE-2013-3129 (fixes bug #477468) to branches 3.8, 3.9, 3.10 and 3.11 were they are present and apply.
Comment 2 GLSAMaker/CVETool Bot gentoo-dev 2013-08-30 01:29:33 UTC
CVE-2013-4125 (
  The fib6_add_rt2node function in net/ipv6/ip6_fib.c in the IPv6 stack in the
  Linux kernel through 3.10.1 does not properly handle Router Advertisement
  (RA) messages in certain circumstances involving three routes that initially
  qualified for membership in an ECMP route set until a change occurred for
  one of the first two routes, which allows remote attackers to cause a denial
  of service (system crash) via a crafted sequence of messages.
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-03-25 15:26:50 UTC
Fix in 3.10.4 onward