CVE-2012-2372: Medium severity linux kernel vulnerability
Last updated 24 July 2024
Other sources
Reported by Li Honggang (internal): Attempting an rds connection from the IP address of an IPoIB interface to itself causes a kernel panic due to a BUGON() being triggered. Making the test less strict allows rds-ping to work without crashing the machine.
A local unprivileged user could use this flaw to crash the sytem.
— Red Hat
The rdsibxmit function in net/rds/ibsend.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel 3.7.4 and earlier allows local users to cause a denial of service (BUGON and kernel panic) by establishing an RDS connection with the source IP address equal to the IPoIB interface's own IP address, as demonstrated by rds-ping.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2372?
CVE-2012-2372 has a high severity due to the potential for kernel panic affecting system stability.
How do I fix CVE-2012-2372?
To fix CVE-2012-2372, upgrade the kernel to version 5.10.223-1 or higher.
Which systems are affected by CVE-2012-2372?
CVE-2012-2372 affects Linux Kernel versions up to and including 3.7.4.
What causes the issue in CVE-2012-2372?
CVE-2012-2372 is caused by a kernel panic triggered when connecting via RDS from an IPoIB interface to itself.
Is CVE-2012-2372 a remote or local vulnerability?
CVE-2012-2372 is considered a local vulnerability, as it requires local access to trigger the kernel panic.