CVE-2009-4272: Input Validation
A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing "emergency" in which a hash chain is too long. NOTE: this is related to an issue in the Linux kernel before 2.6.31, when the kernel routing cache is disabled, involving an uninitialized pointer and a panic.
Other sources
Recently Parallels Virtuozzo Containers team has found a kernel bug that leads to a node freeze. We were able to get the root of the problem: it is linux-2.6-net-allow-for-on-demand-emergency-route-cache-flushing.patch, added in 2.6.18-164.x kernels (i've checked 164.6.1.el5, it still contains the bug).
The calltrace of the deadlocked process: ... rtinternhash( spinlockbh(rthashlockaddr(hash)); rtemergencyhashrebuild rtsecretrebuildoneshot rtcacheflush rtrunflush() for (i = rthashmask; i >= 0; i--) { spinlockbh(rthashlockaddr(i));
deadlock, bh is disabled => all the node quickly becomes "freezed".
We believe this is a security issue, cause this is a remote DOS.
Original raw calltrace:
Route hash chain too long! Adjust your secretinterval! SysRq HELP : loglevel0-8 vscedstAte reBoot Crashdump tErm Full debuG kIll thaw-filesystems(J) saK showMem Nice powerOff showPc unRaw Sync showTasks Unmount shoWcpus SysRq: Show Regs ----------- IPI show regs ----------- Pid: 23107, comm: dcpumon, oopses: 0 EIP: 0060:[<0261abf6>] CPU: 3, VCPU: 9665:2 EIP is at spinlockbh+0xf/0x18 EFLAGS: 00000282 Tainted: P (2.6.18-028stab066.8-ent #1 028stab066) EAX: c00bc000 EBX: d9f25950 ECX: 00000088 EDX: c00bc000 ESI: 00000000 EDI: 00000000 EBP: 00001950 DS: 007b ES: 007b CR0: 80050033 CR2: b7dfa03c CR3: 00799000 CR4: 000006f0 [<025d0da4>] rtrunflush+0x74/0x123 [<025d1bd9>] rtinternhash+0x4a4/0x6f2 [<025d26bf>] iprouteoutputkey+0x898/0x909 [<025d2743>] iprouteoutputflow+0x13/0x24f [<025de3b9>] inetcskroutereq+0xb8/0x1c7 [<025edc9a>] tcpv4sendsynack+0x17/0x169 [<025f072d>] tcpv4connrequest+0x4cc/0x517 [<0261ab57>] readlockbh+0x8/0x17 [<025e7b52>] tcprcvstateprocess+0x5d/0xd66 [<025eebb1>] tcpv4dorcv+0x2c3/0x323 [<025f1781>] tcpv4rcv+0x95e/0x9b1 [<025d60e5>] iplocaldeliver+0x1a6/0x26d [<025d5efc>] iprcv+0x505/0x548
[<025b8b7e>] netifreceiveskb+0x3b2/0x3f0 [<025ba6f7>] processbacklog+0x7e/0xd1 [<025ba8c6>] netrxaction+0x9c/0x1a7 [<024275c4>] dosoftirq+0xe0/0x193 [<024276ad>] dosoftirq+0x36/0x3a [<024277c8>] localbhenable+0x74/0x7f [<025baf37>] devqueuexmit+0x34f/0x380 [<025bf6f4>] neighresolveoutput+0x1a7/0x1d1 [<025db407>] ipoutput+0x299/0x2c2 [<025daa33>] ipqueuexmit+0x4cf/0x515 [<025d26bf>] iprouteoutputkey+0x898/0x909 [<025ef380>] tcpv4sendcheck+0x77/0xbd [<025e9da6>] tcptransmitskb+0x687/0x6b5 [<025ec3e2>] tcpconnect+0x341/0x3c1 [<025f0040>] tcpv4connect+0x708/0x89f [<024690a1>] kunmaphigh+0x14/0x84 [<025fad1d>] inetstreamconnect+0x7d/0x208 [<02475c7a>] getusersize+0x30/0x57 [<025afa9e>] sysconnect+0x6d/0x98 [<0246cfea>] followpagepte+0x173/0x195 [<02475997>] kmapatomicuserpage+0xdb/0xf3 [<024758a8>] kunmapatomicuserpage+0x10/0x24 [<02475c2f>] rwvm+0x10d/0x128 [<025afbe6>] syssocketcall+0x8e/0x1af [<02407400>] dosyscalltrace+0xab/0xb1 ======================= ----------- IPI show regs -----------
-- Best regards,
Konstantin Khorenko, PVC/OpenVZ developer, Parallels
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4272?
CVE-2009-4272 has been classified as a high-severity vulnerability due to its potential to cause denial of service in affected systems.
How do I fix CVE-2009-4272?
To fix CVE-2009-4272, apply the relevant security patches provided by Red Hat for your version of the Linux kernel.
Which systems are affected by CVE-2009-4272?
CVE-2009-4272 affects Red Hat Enterprise Linux 5.0 and systems running the Linux kernel version 2.6.18.
What type of attack does CVE-2009-4272 enable?
CVE-2009-4272 allows remote attackers to execute a denial of service attack by sending specially crafted packets.
Is CVE-2009-4272 exploitable from remote locations?
Yes, CVE-2009-4272 can be exploited by remote attackers to cause a deadlock in the system's routing functionality.