CVE-2008-2358: Buffer Overflow
Description of problem:
Backport the feature length validation. Without this it's possible for rlen to ovelflow to 0, causing kmalloc(0), and a heap overflow during DCCP feature reconciliation. rlen = 1 + opt->dccpoplen; rpref = kmalloc(rlen, GFPATOMIC); memcpy(&rpref[1], opt->dccpopval, opt->dccpoplen); Thanks to Brandon Edwards of McAfee Avert labs for discovering this issue.
Impact:
A vulnerability exists in the DCCP implementation which can be setup and exploited by a local attacker. The vulnerability is an integer overflow which leads to a kmalloc() for 0 bytes, followed by a memory copy into the returned pointer for 255 bytes, which causes a heap overflow. This type of vulnerability can be exploited by a local attacker to gain arbitrary code execution.
Version-Release number of selected component (if applicable): 2.6.17 <= x <= 2.6.20 (See the timeline for more details)
Additional information:
This vulnerability affects the dccp kernel module (shipped as part of the RHEL kernel updates).
Other sources
Integer overflow in the dccpfeatchange function in net/dccp/feat.c in the Datagram Congestion Control Protocol (DCCP) subsystem in the Linux kernel 2.6.18, and 2.6.17 through 2.6.20, allows local users to gain privileges via an invalid feature length, which leads to a heap-based buffer overflow.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2358?
CVE-2008-2358 has a medium severity rating due to its potential for heap overflow.
How do I fix CVE-2008-2358?
To fix CVE-2008-2358, update the Linux kernel to a version that includes the patch for feature length validation.
What versions of Linux Kernel are affected by CVE-2008-2358?
CVE-2008-2358 affects Linux Kernel versions 2.6.17, 2.6.18, 2.6.19, and 2.6.20.
What type of vulnerability is CVE-2008-2358?
CVE-2008-2358 is a heap overflow vulnerability that can occur during DCCP feature reconciliation.
Is CVE-2008-2358 a remote exploit?
CVE-2008-2358 can potentially be exploited remotely if the affected kernel versions are exposed.