CVE-2011-1093: Null Pointer Dereference
Last updated 24 July 2024
Other sources
The dccprcvstateprocess function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP) implementation in the Linux kernel before 2.6.38 does not properly handle packets for a CLOSED endpoint, which allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending a DCCP-Close packet followed by a DCCP-Reset packet.
— Launchpad
This fixes a bug in the order of dccprcvstateprocess() that still permitted reception even after closing the socket. A Reset after close thus causes a NULL pointer dereference by not preventing operations on an already torn-down socket.
dccpv4dorcv() | | state other than OPEN v dccprcvstateprocess() | | DCCPPKTRESET v dccprcvreset() | v dccptimewait()
WARNING: at net/ipv4/inettimewaitsock.c:141 inettwskhashdance+0x48/0x128() Modules linked in: arc4 ecb carl9170 rt2870sta(C) mac80211 r8712u(C) crcccitt ah [<c0038850>] (unwindbacktrace+0x0/0xec) from [<c0055364>] (warnslowpathcommon) [<c0055364>] (warnslowpathcommon+0x4c/0x64) from [<c0055398>] (warnslowpathn) [<c0055398>] (warnslowpathnull+0x1c/0x24) from [<c02b72d0>] (inettwskhashd) [<c02b72d0>] (inettwskhashdance+0x48/0x128) from [<c031caa0>] (dccptimewai) [<c031caa0>] (dccptimewait+0x40/0xc8) from [<c031c15c>] (dccprcvstateproces) [<c031c15c>] (dccprcvstateprocess+0x120/0x538) from [<c032609c>] (dccpv4do) [<c032609c>] (dccpv4dorcv+0x11c/0x14c) from [<c0286594>] (releasesock+0xac/0) [<c0286594>] (releasesock+0xac/0x110) from [<c031fd34>] (dccpclose+0x28c/0x380) [<c031fd34>] (dccpclose+0x28c/0x380) from [<c02d9a78>] (inetrelease+0x64/0x70)
The fix is by testing the socket state first. Receiving a packet in Closed state now also produces the required "No connection" Reset reply of RFC 4340, 8.3.1.
Upstream commit: http://git.kernel.org/linus/720dc34bbbe9493c7bd48b2243058b4e447a929d
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1093?
CVE-2011-1093 has a severity rating that indicates it could allow remote attackers to cause a denial of service.
How do I fix CVE-2011-1093?
To fix CVE-2011-1093, ensure you upgrade to a version of the Linux kernel higher than 2.6.38.
Which Linux kernel versions are affected by CVE-2011-1093?
CVE-2011-1093 affects Linux kernel versions before 2.6.38.
What type of vulnerability is CVE-2011-1093?
CVE-2011-1093 is a denial of service vulnerability associated with the Datagram Congestion Control Protocol (DCCP).
Can CVE-2011-1093 be exploited remotely?
Yes, CVE-2011-1093 can be exploited remotely by attackers to affect a closed endpoint.