CVE-2009-4536: High severity linux kernel vulnerability
Description of problem: This was disclosed at 26c3.
Fabian mentioned that CVE-2009-1385 has an incorrect fix. The fix he points to is http://git.kernel.org/linus/ea30e11970a96cfe5e32c03a29332554573b4a10
Which fixes a DoS when the frame spans multiple buffers and the last buffer contains less than four bytes. However, if that last fragment is longer than 4 bytes, it will actually be taken into account while the previous fragments will have been ignored. This means we can end up in a situation where a single Ethernet frame has multiple interpretation since at some level it will be considered as a whole and in others the N first bytes will be silently discarded.
References: http://events.ccc.de/congress/2009/Fahrplan//events/3596.en.html http://blog.c22.cc/2009/12/27/26c3-cat-procsysnetipv4fuckups/ http://twitter.com/dakami/statuses/7104238406 https://bugzilla.redhat.com/CVE-2009-1385 http://www.securityfocus.com/bid/37519
Other sources
drivers/net/e1000/e1000main.c in the e1000 driver in the Linux kernel 2.6.32.3 and earlier handles Ethernet frames that exceed the MTU by processing certain trailing payload data as if it were a complete frame, which allows remote attackers to bypass packet filters via a large packet with a crafted payload. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1385.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2009-4536?
CVE-2009-4536 is classified as a high severity vulnerability due to its potential to allow remote attackers to bypass security measures.
How do I fix CVE-2009-4536?
To fix CVE-2009-4536, update the Linux kernel to versions higher than 2.6.32.3 or the specific remedial versions for your distribution.
What specific versions of the Linux kernel are affected by CVE-2009-4536?
CVE-2009-4536 affects Linux kernel versions up to and including 2.6.32.3.
Can CVE-2009-4536 be exploited remotely?
Yes, CVE-2009-4536 can be exploited remotely by sending crafted large packets that exceed the MTU.
Is my system at risk if I am using an affected version of the Linux kernel?
Yes, systems running affected versions of the Linux kernel are at risk and should be updated immediately to mitigate the vulnerability.