A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing "emergency" in which a hash chain is too long. NOTE: this is related to an issue in the Linux kernel before 2.6.31, when the kernel routing cache is disabled, involving an uninitialized pointer and a panic.

Description of problem: CVE-2009-3553 (bug #530111) has not been completely fixed.

Version-Release number of selected component (if applicable): Versions known to be affected:

cups-1.3.7-11.el54.5 (RHEL-5.4.z) cups-1.3.7-16.el5 (RHEL-5)

Additional info: The cause is that the cupsdDoSelect() function uses one of several implementations depending on the underlying select/poll capabilities of the operating system. For kqueue and epoll implementations, cupsdRemoveSelect() does not immediately decrease the reference count for the file descriptor and instead adds it to the cupsdinactivefds array. File descriptors in that array are finally dereferenced in cupsdStopSelect() (i.e. program termination).

In Red Hat Enterprise Linux, the epoll implementation is used.

The previous fix for CVE-2009-3553 was to check that another reference was held for the file descriptor before calling the writecb function; however, that will always be the case for both the epoll and kqueue implementations.

The correct fix is to check whether the file descriptor is in the cupsdinactivefds array before calling the writecb function.