Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 505666 (CVE-2014-0100) - Kernel: net: inet frag code race condition leading to user-after-free (CVE-2014-0100)
Summary: Kernel: net: inet frag code race condition leading to user-after-free (CVE-20...
Status: RESOLVED FIXED
Alias: CVE-2014-0100
Product: Gentoo Security
Classification: Unclassified
Component: Kernel (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Kernel Security
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-03-25 11:59 UTC by Agostino Sarubbo
Modified: 2022-03-25 19:45 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-03-25 11:59:56 UTC 
CVE-2014-0100 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0100):

Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel through 
3.13.6 allows remote attackers to cause a denial of service (use-after-free error) or possibly have 
unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a 
heavy CPU load.
Comment 1 GLSAMaker/CVETool Bot gentoo-dev 2014-08-10 22:04:28 UTC 
CVE-2014-0100 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0100):
  Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c
  in the Linux kernel through 3.13.6 allows remote attackers to cause a denial
  of service (use-after-free error) or possibly have unspecified other impact
  via a large series of fragmented ICMP Echo Request packets to a system with
  a heavy CPU load.
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-03-25 19:45:36 UTC 
Fixed in 3.14 onwards as 3ef0eb0db4bf