CVE-2013-4563: High severity linux kernel vulnerability
Commit 1e2bd517c108816220f262d7954b697af03b5f9c ("udp6: Fix udp fragmentation for tunnel traffic.") changed the calculation if there is enough space to include a fragment header in the skb from a skb->macheader dervived one to skbheadroom. Because we already peeled off the skb to transportheader this is wrong.
This fixes a panic Saran Neti reported. He used the tbf scheduler which skbgsosegments the skb. The offsets get negative and we panic in memcpy because the skb was erroneously not expanded at the head.
Introduced by: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1e2bd517c108816220f262d7954b697af03b5f9c
Introduced in: v3.10-rc5
Upstream fix: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0e033e0
References: http://marc.info/?l=linux-netdev&m=138305762205012&w=2
Acknowledgements:
Red Hat would like to thank Saran Neti of TELUS Security Labs for reporting this issue.
Other sources
The udp6ufofragment function in net/ipv6/udpoffload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of service (panic) via a large IPv6 UDP packet, as demonstrated by use of the Token Bucket Filter (TBF) queueing discipline.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4563?
CVE-2013-4563 has a medium severity level, affecting the fragmentation handling in the Linux kernel.
How do I fix CVE-2013-4563?
To fix CVE-2013-4563, update the Linux kernel to a version that includes the patches mentioned in the vulnerability report.
Which versions of the Linux Kernel are affected by CVE-2013-4563?
CVE-2013-4563 affects Linux Kernel versions between 3.9.8 and 3.10.23, as well as 3.11.x versions up to 3.12.4.
Is Ubuntu Linux vulnerable to CVE-2013-4563?
Yes, Ubuntu versions 12.04 and 13.10 are vulnerable to CVE-2013-4563.
What are the recommended kernel versions to mitigate CVE-2013-4563?
Recommended kernel versions to mitigate CVE-2013-4563 include 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.10-1, and 6.12.11-1.