CVE-2009-1298: Buffer Overflow
First published: Fri Dec 04 2009(Updated: )
Description of problem: ipv4: additional update of dev_net(dev) to struct *net in ip_fragment.c, NULL ptr OOPS ipv4 ip_frag_reasm(), fully replace 'dev_net(dev)' with 'net', defined previously patched into 2.6.29. Between 2.6.28.10 and 2.6.29, net/ipv4/ip_fragment.c was patched, changing from dev_net(dev) to container_of(...). Unfortunately the goto section (out_fail) on oversized packets inside ip_frag_reasm() didn't get touched up as well. Oversized IP packets cause a NULL pointer dereference and immediate hang. I discovered this running openvasd and my previous email on this is titled: NULL pointer dereference at 2.6.32-rc8:net/ipv4/ip_fragment.c:566 Upstream commit: <a href="http://git.kernel.org/linus/bbf31bf18d34caa87dd01f08bf713635593697f2">http://git.kernel.org/linus/bbf31bf18d34caa87dd01f08bf713635593697f2</a> Reference: <a href="http://lkml.org/lkml/2009/11/25/104">http://lkml.org/lkml/2009/11/25/104</a>
Credit: security@ubuntu.com security@ubuntu.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Linux kernel | =2.6.28-rc4 | |
| Linux Linux kernel | =2.6.29-rc8-kk | |
| Linux Linux kernel | =2.6.31 | |
| Linux Linux kernel | =2.6.29.3 | |
| Linux Linux kernel | =2.6.31-rc4 | |
| Linux Linux kernel | =2.6.32-rc1 | |
| Linux Linux kernel | =2.6.32-rc5 | |
| Linux Linux kernel | =2.6.31.3 | |
| Linux Linux kernel | =2.6.30-rc2 | |
| Linux Linux kernel | =2.6.29 | |
| Linux Linux kernel | =2.6.30-rc3 | |
| Linux Linux kernel | =2.6.31.4 | |
| Linux Linux kernel | =2.6.32 | |
| Linux Linux kernel | =2.6.31.6 | |
| Linux Linux kernel | =2.6.28.4 | |
| Linux Linux kernel | =2.6.28.2 | |
| Linux Linux kernel | =2.6.28.5 | |
| Linux Linux kernel | =2.6.31-rc1 | |
| Linux Linux kernel | =2.6.32-rc6 | |
| Linux Linux kernel | =2.6.31-rc6 | |
| Linux Linux kernel | =2.6.31.1 | |
| Linux Linux kernel | =2.6.30.7 | |
| Linux Linux kernel | =2.6.28-rc5 | |
| Linux Linux kernel | =2.6.29.4 | |
| Linux Linux kernel | =2.6.28-rc1 | |
| Linux Linux kernel | =2.6.30.8 | |
| Linux Linux kernel | =2.6.30.9 | |
| Linux Linux kernel | =2.6.32-rc4 | |
| Linux Linux kernel | =2.6.30-rc5 | |
| Linux Linux kernel | =2.6.29-rc2 | |
| Linux Linux kernel | =2.6.28.8 | |
| Linux Linux kernel | =2.6.31-rc5 | |
| Linux Linux kernel | =2.6.29.1 | |
| Linux Linux kernel | =2.6.28-rc7 | |
| Linux Linux kernel | =2.6.30.4 | |
| Linux Linux kernel | =2.6.28.3 | |
| Linux Linux kernel | =2.6.28-rc6 | |
| Linux Linux kernel | =2.6.32-rc7 | |
| Linux Linux kernel | <=2.6.32 | |
| Linux Linux kernel | =2.6.31-rc7 | |
| Linux Linux kernel | =2.6.29.6 | |
| Linux Linux kernel | =2.6.29-rc2_git7 | |
| Linux Linux kernel | =2.6.28.9 | |
| Linux Linux kernel | =2.6.30.2 | |
| Linux Linux kernel | =2.6.30.6 | |
| Linux Linux kernel | =2.6.30.1 | |
| Linux Linux kernel | =2.6.28.6 | |
| Linux Linux kernel | =2.6.31.5 | |
| Linux Linux kernel | =2.6.28.7 | |
| Linux Linux kernel | =2.6.31-rc8 | |
| Linux Linux kernel | =2.6.28-rc3 | |
| Linux Linux kernel | =2.6.31-rc3 | |
| Linux Linux kernel | =2.6.30-rc4 | |
| Linux Linux kernel | =2.6.29.2 | |
| Linux Linux kernel | =2.6.31-rc2 | |
| Linux Linux kernel | =2.6.28-rc2 | |
| Linux Linux kernel | =2.6.31.2 | |
| Linux Linux kernel | =2.6.30-rc6 | |
| Linux Linux kernel | =2.6.32-rc3 | |
| Linux Linux kernel | =2.6.30.5 | |
| Linux Linux kernel | =2.6.28.1 | |
| Linux Linux kernel | =2.6.30-rc1 | |
| Linux Linux kernel | =2.6.30 | |
| Linux Linux kernel | =2.6.30-rc7-git6 | |
| Linux Linux kernel | =2.6.28.10 | |
| Linux Linux kernel | =2.6.30.3 | |
| Linux Linux kernel | =2.6.28 | |
| Linux Linux kernel | =2.6.29.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00496.html
- http://www.osvdb.org/60788
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00453.html
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=bbf31bf18d34caa87dd01f08bf713635593697f2
- https://bugzilla.redhat.com/show_bug.cgi?id=544144
- http://secunia.com/advisories/37624
- http://twitter.com/spendergrsec/statuses/6339560349
- http://www.theregister.co.uk/2009/12/11/linux_kernel_bugs_patched/
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:329
- http://www.ubuntu.com/usn/USN-869-1
- http://wiki.rpath.com/Advisories:rPSA-2009-0161
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html
- http://secunia.com/advisories/38017
- http://www.securityfocus.com/archive/1/508517/100/0/threaded
- http://git.kernel.org/linus/bbf31bf18d34caa87dd01f08bf713635593697f2
- http://lkml.org/lkml/2009/11/25/104
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=bbf31bf18d34caa87dd01f08bf713635593697f2
- collector/nvd-historical
- collector/nvd-index
- collector/nvd-api
- agent/weakness
- agent/author
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2009-1298
- agent/tags
- agent/trending
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/2.6.28-rc4
- version/linux linux kernel/2.6.29-rc8-kk
- version/linux linux kernel/2.6.31
- version/linux linux kernel/2.6.29.3
- version/linux linux kernel/2.6.31-rc4
- version/linux linux kernel/2.6.32-rc1
- version/linux linux kernel/2.6.32-rc5
- version/linux linux kernel/2.6.31.3
- version/linux linux kernel/2.6.30-rc2
- version/linux linux kernel/2.6.29
- version/linux linux kernel/2.6.30-rc3
- version/linux linux kernel/2.6.31.4
- version/linux linux kernel/2.6.32
- version/linux linux kernel/2.6.31.6
- version/linux linux kernel/2.6.28.4
- version/linux linux kernel/2.6.28.2
- version/linux linux kernel/2.6.28.5
- version/linux linux kernel/2.6.31-rc1
- version/linux linux kernel/2.6.32-rc6
- version/linux linux kernel/2.6.31-rc6
- version/linux linux kernel/2.6.31.1
- version/linux linux kernel/2.6.30.7
- version/linux linux kernel/2.6.28-rc5
- version/linux linux kernel/2.6.29.4
- version/linux linux kernel/2.6.28-rc1
- version/linux linux kernel/2.6.30.8
- version/linux linux kernel/2.6.30.9
- version/linux linux kernel/2.6.32-rc4
- version/linux linux kernel/2.6.30-rc5
- version/linux linux kernel/2.6.29-rc2
- version/linux linux kernel/2.6.28.8
- version/linux linux kernel/2.6.31-rc5
- version/linux linux kernel/2.6.29.1
- version/linux linux kernel/2.6.28-rc7
- version/linux linux kernel/2.6.30.4
- version/linux linux kernel/2.6.28.3
- version/linux linux kernel/2.6.28-rc6
- version/linux linux kernel/2.6.32-rc7
- version/linux linux kernel/2.6.31-rc7
- version/linux linux kernel/2.6.29.6
- version/linux linux kernel/2.6.29-rc2_git7
- version/linux linux kernel/2.6.28.9
- version/linux linux kernel/2.6.30.2
- version/linux linux kernel/2.6.30.6
- version/linux linux kernel/2.6.30.1
- version/linux linux kernel/2.6.28.6
- version/linux linux kernel/2.6.31.5
- version/linux linux kernel/2.6.28.7
- version/linux linux kernel/2.6.31-rc8
- version/linux linux kernel/2.6.28-rc3
- version/linux linux kernel/2.6.31-rc3
- version/linux linux kernel/2.6.30-rc4
- version/linux linux kernel/2.6.29.2
- version/linux linux kernel/2.6.31-rc2
- version/linux linux kernel/2.6.28-rc2
- version/linux linux kernel/2.6.31.2
- version/linux linux kernel/2.6.30-rc6
- version/linux linux kernel/2.6.32-rc3
- version/linux linux kernel/2.6.30.5
- version/linux linux kernel/2.6.28.1
- version/linux linux kernel/2.6.30-rc1
- version/linux linux kernel/2.6.30
- version/linux linux kernel/2.6.30-rc7-git6
- version/linux linux kernel/2.6.28.10
- version/linux linux kernel/2.6.30.3
- version/linux linux kernel/2.6.28
- version/linux linux kernel/2.6.29.5