CVE-2011-1767: Medium severity linux kernel vulnerability
Description: 1) CVE-2011-1767 gre: fix netns vs proto registration ordering
GRE protocol receive hook can be called right after protocol addition is done. If netns stuff is not yet initialized, we're going to oops in netgeneric().
This is remotely oopsable if ipgre is compiled as module and packet comes at unfortunate moment of module loading.
Upstream commit: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=c2892f02
References: http://www.openwall.com/lists/oss-security/2010/02/18/3 http://patchwork.ozlabs.org/patch/45553/
2) CVE-2011-1768 tunnels: fix netns vs proto registration ordering
Same stuff as in ipgre patch: receive hook can be called before netns setup is done, oopsing in netgeneric().
Upstream commit: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=d5aa407f
References: http://www.openwall.com/lists/oss-security/2010/02/18/3 http://patchwork.ozlabs.org/patch/45554/
Other sources
net/ipv4/ipgre.c in the Linux kernel before 2.6.34, when ipgre is configured as a module, allows remote attackers to cause a denial of service (OOPS) by sending a packet during module loading.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1767?
CVE-2011-1767 is rated as important due to potential system instability and kernel crashes.
How do I fix CVE-2011-1767?
To mitigate CVE-2011-1767, update the Linux kernel to version 2.6.33.20 or later.
What systems are affected by CVE-2011-1767?
CVE-2011-1767 affects multiple versions of the Linux kernel, specifically those earlier than 2.6.33.20.
What kind of vulnerability is CVE-2011-1767?
CVE-2011-1767 is a vulnerability that stems from improper initialization during network protocol registration.
Can CVE-2011-1767 cause denial of service?
Yes, CVE-2011-1767 can lead to denial of service if the kernel encounters instability or crashes.