CVE-2011-1770: Integer Underflow
Integer underflow in the dccpparseoptions function (net/dccp/options.c) in the Linux kernel before 2.6.33.14 allows remote attackers to cause a denial of service via a Datagram Congestion Control Protocol (DCCP) packet with an invalid feature options length, which triggers a buffer over-read.
Other sources
length of zero (after subtracting two for the type and len fields) for the DCCPO{CHANGE,CONFIRM}{L,R} options will cause an underflow due to the subtraction. The subsequent code may read past the end of the options value buffer when parsing.
http://marc.info/?l=linux-kernel&m=130468845209036&w=2
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1770?
CVE-2011-1770 is classified as a medium severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2011-1770?
To fix CVE-2011-1770, you should upgrade your Linux kernel to version 2.6.33.14 or later.
What systems are affected by CVE-2011-1770?
CVE-2011-1770 affects versions of the Linux kernel before 2.6.33.14, specifically on Debian and Fedora systems.
What type of vulnerability is CVE-2011-1770?
CVE-2011-1770 is an integer underflow vulnerability that can lead to a buffer over-read.
Can CVE-2011-1770 be exploited remotely?
Yes, CVE-2011-1770 can be exploited remotely via specially crafted Datagram Congestion Control Protocol (DCCP) packets.