kernel: dccp: handle invalid feature options length
Published Jun 24, 2011
7.5
HIGHCVSS 3.1
EPSS 4.36%
Description
Integer underflow in the dccp_parse_options function (net/dccp/options.c) in the Linux kernel before 2.6.33.14 allows remote attackers to cause a denial of service via a Datagram Congestion Control Protocol (DCCP) packet with an invalid feature options length, which triggers a buffer over-read.
Affected products
No data.
Configuration 1
- < 2.6.33.14
Configuration 2
- 14
- 15
No data.
Red Hat Enterprise Linux 6
kernel-0:2.6.32-131.2.1.el6
Fixed · RHSA-2011:0836
Red Hat Enterprise MRG 2
kernel-rt-0:2.6.33.9-rt31.75.el6rt
Fixed · RHSA-2011:1253
Red Hat Enterprise Linux 4
kernel
Not affected
Red Hat Enterprise Linux 5
kernel
Not affected
Red Hat Enterprise MRG 1
kernel-rt
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel-0:2.6.32-131.2.1.el6 | Fixed | RHSA-2011:0836 |
| Red Hat Enterprise MRG 2 | kernel-rt-0:2.6.33.9-rt31.75.el6rt | Fixed | RHSA-2011:1253 |
| Red Hat Enterprise Linux 4 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 5 | kernel | Not affected | n/a |
| Red Hat Enterprise MRG 1 | kernel-rt | Affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
This issue does not affect Red Hat Enterprise Linux 4 and 5: Red Hat Enterprise Linux 4 does not provide support for the Datagram Congestion Control Protocol (DCCP), and Red Hat Enterprise Linux 5, which does support DCCP, did not backport the upstream commit that introduced this issue, e77b8363b. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0836.html and https://rhn.redhat.com/errata/RHSA-2011-1253.html.
References (13)
- http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061236.html vendor-advisoryx_refsource_FEDORAThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061366.html vendor-advisoryx_refsource_FEDORAPatchThird Party Advisory
- http://marc.info/?l=linux-kernel&m=130468845209036&w=2 mailing-listx_refsource_MLISTPatchThird Party Advisory
- http://marc.info/?l=linux-kernel&m=130469305815140&w=2 mailing-listx_refsource_MLISTPatchThird Party Advisory
- http://secunia.com/advisories/44932 third-party-advisoryx_refsource_SECUNIAThird Party AdvisoryVendor Advisory
- http://securityreason.com/securityalert/8286 third-party-advisoryx_refsource_SREASONThird Party Advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/longterm/v2.6.33/ChangeLog-2.6.33.14 x_refsource_CONFIRMRelease NotesVendor Advisory
- http://www.securityfocus.com/bid/47769 vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id?1025592 vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
- https://access.redhat.com/security/cve/CVE-2011-1770 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=703011 x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2011-1770
- https://www.cve.org/CVERecord?id=CVE-2011-1770
Change history (0)
No recorded changes yet.