CVE-2010-4161: Medium severity Linux Linux kernel vulnerability
The udpqueuercvskb function in net/ipv4/udp.c in a certain Red Hat build of the Linux kernel 2.6.18 in Red Hat Enterprise Linux (RHEL) 5 allows attackers to cause a denial of service (deadlock and system hang) by sending UDP traffic to a socket that has a crafted socket filter, a related issue to CVE-2010-4158.
Other sources
Using the reproducer for CVE-2010-4158, BUG: soft lockup - CPU#2 stuck for 60s! [a.out:4362] CPU 2: Modules linked in: autofs4 hidp rfcomm l2cap bluetooth lockd sunrpc cpufreqondemand acpicpufreq freqtable mperf ipv6 xfrmnalgo cryptoapi loop dmmultipath scsidh video backlight sbs powermeter hwmon i2cec i2ccore dellwmi wmi button battery asusacpi acpimemhotplug ac parportpc lp parport joydev ixgbe floppy bnx2 8021q idecd srmod i5000edac serioraw dca edacmc tpmtis cdrom tpm tpmbios sg pcspkr dmraid45 dmmessage dmregionhash dmmemcache dmsnapshot dmzero dmmirror dmlog dmmod usbstorage atapiix libata shpchp megaraidsas sdmod scsimod ext3 jbd uhcihcd ohcihcd ehcihcd Pid: 4362, comm: a.out Not tainted 2.6.18-231.el5 #1 RIP: 0010:[<ffffffff80064bbf>] [<ffffffff80064bbf>] .text.lock.spinlock+0x5/0x30 RSP: 0018:ffff81010ebebd90 EFLAGS: 00000286 RAX: 0000000000000000 RBX: ffff81042bf57e80 RCX: 0000000000000002 RDX: 0000000000000036 RSI: 0000000000000003 RDI: ffff81042b56b0c0 RBP: ffff81010ebebd10 R08: ffff81010ebebc78 R09: 0000000000000000 R10: ffff81010ebebcf8 R11: 0000000000000048 R12: ffffffff8005dc8e R13: ffff81042b56b080 R14: ffffffff80078f66 R15: ffff81010ebebd10 FS: 00002b0ab82d06e0(0000) GS:ffff81010eb9ee40(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 00002b0ab804ce30 CR3: 0000000424dce000 CR4: 00000000000006e0
Call Trace: <IRQ> [<ffffffff8022db6a>] sockqueuercvskb+0x56/0x16b [<ffffffff80261fd5>] udpqueuercvskb+0x9/0x3b [<ffffffff8005313f>] udpqueuercvskb+0x283/0x2d6 [<ffffffff80052d74>] udprcv+0x3e5/0x52d [<ffffffff80046fbc>] trytowakeup+0x472/0x484 [<ffffffff80034950>] iplocaldeliver+0x19d/0x263 [<ffffffff80035aac>] iprcv+0x539/0x57c [<ffffffff80020b0f>] netifreceiveskb+0x470/0x49f [<ffffffff800a486c>] hrtimerwakeup+0x1d/0x22 [<ffffffff800307d3>] processbacklog+0x89/0xe7 [<ffffffff8000c979>] netrxaction+0xac/0x1b3 [<ffffffff8001245b>] dosoftirq+0x89/0x133 [<ffffffff8005e2fc>] callsoftirq+0x1c/0x28 <EOI> [<ffffffff8006d5f5>] dosoftirq+0x2c/0x7d [<ffffffff8002baf1>] localbhenable+0x88/0x99 [<ffffffff8002fa6c>] devqueuexmit+0x27e/0x2a2 [<ffffffff8003205b>] ipoutput+0x2ae/0x2dd [<ffffffff80251dad>] ippushpendingframes+0x37d/0x45d [<ffffffff80262264>] udppushpendingframes+0x21e/0x243 [<ffffffff8005287d>] udpsendmsg+0x4d8/0x5ea [<ffffffff80055229>] socksendmsg+0xf8/0x14a [<ffffffff800a2896>] autoremovewakefunction+0x0/0x2e [<ffffffff80008d56>] handlemmfault+0x5f3/0x1039 [<ffffffff80062ff0>] threadreturn+0x62/0xfe [<ffffffff8022aeac>] syssendto+0x11c/0x14f [<ffffffff8005a4c5>] hrtimercancel+0xc/0x16 [<ffffffff80063ce5>] donanosleep+0x47/0x70 [<ffffffff8005a3b2>] hrtimernanosleep+0x58/0x118 [<ffffffff8005d28d>] tracesys+0xd5/0xe0
So the deadlock was happen as following: udpqueuercvskb | bhlocksock(sk) | udpqueuercvskb | sockqueuercvskb | skfilter(sk, skb, 1) -> 1 means needlock | bhlocksock(sk) -> deadlock
This is a regression introduced by rhel5 commit 6865201191, the upstream is okay because skfilter was adopted to rcu protection, but rhel5 hasn't taken the skfilter changes, so after we take commit 6865201191 in, we have a deadlock.
Found with Dan's reproducer for CVE-2010-4158.
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4161?
CVE-2010-4161 has a high severity rating due to its potential to cause denial of service through system hangs.
How does CVE-2010-4161 affect the system?
CVE-2010-4161 allows attackers to create a deadlock situation on a system by sending specially crafted UDP traffic to a vulnerable socket.
How do I fix CVE-2010-4161?
To fix CVE-2010-4161, apply the latest security patches for Red Hat Enterprise Linux 5 and the affected Linux kernel version.
Which systems are affected by CVE-2010-4161?
CVE-2010-4161 primarily affects Red Hat Enterprise Linux 5 and Linux kernel version 2.6.18.
What precautionary measures can I take against CVE-2010-4161?
To mitigate the risk of CVE-2010-4161, limit access to vulnerable UDP sockets and monitor suspicious UDP traffic.