CVE-2010-4251: High severity Linux Linux kernel vulnerability
http://kerneltrap.org/mailarchive/linux-netdev/2010/3/3/6271093/thread "The root cause for this problem is, when the receiver is doing releasesock() (i.e. after userspace recv, kernel udprecvmsg->skbfreedatagramlocked->releasesock), it moves skbs from backlog to skreceivequeue with the softirq enabled. In the above case, multiple busy senders will almost make it an endless loop. The skbs in the backlog end up eat all the system memory.
The issue is not only for UDP. Any protocols using socket backlog is potentially affected. The patch adds limit for socket backlog so that the backlog size cannot be expanded endlessly."
Upstream commits: http://git.kernel.org/linus/2499849ee8f513e795b9f2c19a42d6356e4943a4 http://git.kernel.org/linus/53eecb1be5ae499d399d2923933937a9ea1a284f http://git.kernel.org/linus/50b1a782f845140f4138f14a1ce8a4a6dd0cc82f http://git.kernel.org/linus/79545b681961d7001c1f4c3eb9ffb87bed4485db http://git.kernel.org/linus/55349790d7cbf0d381873a7ece1dcafcffd4aaa9 http://git.kernel.org/linus/6b03a53a5ab7ccf2d5d69f96cf1c739c4d2a8fb9 http://git.kernel.org/linus/8eae939f1400326b06d0c9afe53d2a484a326871 http://git.kernel.org/linus/a3a858ff18a72a8d388e31ab0d98f7e944841a62 http://git.kernel.org/linus/c377411f2494a931ff7facdbb3a6839b1266bcf6
Other sources
The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service (memory consumption) by sending a large amount of network traffic, as demonstrated by netperf UDP tests.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4251?
CVE-2010-4251 is classified as a medium severity vulnerability.
How do I fix CVE-2010-4251?
To remediate CVE-2010-4251, update the Linux kernel to version 2.6.34 or later.
Which systems are affected by CVE-2010-4251?
CVE-2010-4251 affects various Linux kernel versions prior to 2.6.34, VMware ESX 4.0 and 4.1, as well as Red Hat Enterprise Linux 4.0.
What type of vulnerability is CVE-2010-4251?
CVE-2010-4251 is a vulnerability related to improper handling of UDP socket messages.
Can CVE-2010-4251 be exploited remotely?
Yes, CVE-2010-4251 can potentially be exploited by an attacker remotely through crafted UDP packets.