CVE-2011-2699: High severity linux kernel vulnerability
IPv6 fragment identification generation is way beyond what we use for IPv4 : It uses a single generator. Its not scalable and allows DOS attacks.
Now inetpeer is IPv6 aware, we can use it to provide a more secure and scalable frag ident generator (per destination, instead of system wide)
This patch : 1) defines a new secureipv6id() helper 2) extends inetgetid() to provide 32bit results 3) extends ipv6selectident() with a new dest parameter
http://thread.gmane.org/gmane.linux.network/201773
Acknowledgements:
Red Hat would like to thank Fernando Gont for reporting this issue.
Other sources
The IPv6 implementation in the Linux kernel before 3.1 does not generate Fragment Identification values separately for each destination, which makes it easier for remote attackers to cause a denial of service (disrupted networking) by predicting these values and sending crafted packets.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2699?
CVE-2011-2699 has a high severity level due to its potential to allow Denial of Service (DoS) attacks.
How do I fix CVE-2011-2699?
To fix CVE-2011-2699, update to a Linux kernel version 3.1 or later where the fragmentation identification generation is addressed.
What systems are affected by CVE-2011-2699?
CVE-2011-2699 affects various Linux kernel versions, particularly those prior to 3.1, and specific releases of Red Hat Enterprise Linux and Enterprise MRG.
What type of attack does CVE-2011-2699 facilitate?
CVE-2011-2699 facilitates Denial of Service (DoS) attacks by using a single identifier generator that lacks scalability.
Is CVE-2011-2699 specific to IPv6?
Yes, CVE-2011-2699 is specifically related to IPv6 fragment identification generation issues.