CVE-2012-3412: High severity Linux Linux kernel vulnerability
A peer (or local user) may cause TCP to use a nominal MSS of as little as 88 (actual MSS of 76 with timestamps). Given that we have a sufficiently prodigious local sender and the peer ACKs quickly enough, it is nevertheless possible to grow the window for such a connection to the point that we will try to send just under 64K at once. This results in a single skb that expands to 861 segments.
In some drivers with TSO support, such an skb will require hundreds of DMA descriptors; a substantial fraction of a TX ring or even more than a full ring. The TX queue selected for the skb may stall and trigger the TX watchdog repeatedly (since the problem skb will be retried after the TX reset).
Upstream patch: http://www.spinics.net/lists/netdev/msg206332.html
References: http://seclists.org/oss-sec/2012/q3/171
Acknowledgements:
Red Hat would like to thank Ben Hutchings of Solarflare (tm) for reporting this issue.
Other sources
The sfc (aka Solarflare Solarstorm) driver in the Linux kernel before 3.2.30 allows remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3412?
CVE-2012-3412 is considered medium severity.
How do I fix CVE-2012-3412?
To resolve CVE-2012-3412, update the Linux kernel to a version that is not vulnerable, such as 3.0.44 or later.
What versions of Linux Kernel are affected by CVE-2012-3412?
CVE-2012-3412 affects Linux Kernel versions up to 3.0.44 and certain versions between 3.1 and 3.5.5.
What types of users can exploit CVE-2012-3412?
CVE-2012-3412 can be exploited by peers or local users who can control TCP connections.
Is CVE-2012-3412 a local or remote vulnerability?
CVE-2012-3412 is primarily a local vulnerability, as it requires access to the affected system.