CVE-2012-3552: Race Condition
Description of the problem: Lack proper synchronization to manipulate inet->opt ipoptions can lead to system crash.
Problem is that ipmakeskb() calls ipsetupcork() and ipsetupcork() possibly makes a copy of ipc->opt (struct ipoptions), without any protection against another thread manipulating inet->opt. Another thread can change inet->opt pointer and free old one under us.
Given right server application (setting socket options and processing traffic over the same socket at the same time), remote attacker could use this flaw to crash the system. More likely though, local unprivileged user could use this flaw to crash the system.
Potential privilege escalation impact cannot be ruled out.
Upstream fix: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=f6d8bd051c391c1c0458a30b2a7abcd939329259
Other sources
Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3552?
CVE-2012-3552 has been classified as a high severity vulnerability due to the potential for system crashes.
How do I fix CVE-2012-3552?
Fixing CVE-2012-3552 requires upgrading the Linux kernel to a version above 3.0 or applying the relevant patches provided by the Linux community.
Which software is affected by CVE-2012-3552?
CVE-2012-3552 affects the Linux kernel versions up to 3.0 and Red Hat Enterprise Linux EUS version 6.2.
What kind of issue does CVE-2012-3552 represent?
CVE-2012-3552 represents a synchronization issue that can lead to improper handling of IP options and potential system crashes.
Who reported CVE-2012-3552?
CVE-2012-3552 was reported through a bug tracking system, highlighting the lack of synchronization in the handling of IP options.