Bug 177496

Summary:	CVE-2006-0035 netlink DoS
Product:	Red Hat Enterprise Linux 4	Reporter:	Mark J. Cox <mjc>
Component:	kernel	Assignee:	Thomas Graf <tgraf>
Status:	CLOSED NOTABUG	QA Contact:	Brian Brock <bbrock>
Severity:	high	Docs Contact:
Priority:	medium
Version:	4.0	CC:	jbaron, rkhan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	reported=20060109,public=2006010:2102,impact=important,source=kernel
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-01-11 23:39:26 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mark J. Cox 2006-01-11 10:22:24 UTC

A netlink message with nlmsg_len set to 0 can cause an infinite loop holding the
netlink semaphore therefore allowing a local unprivileged DoS.

Here is the upstream fix for this issue:

http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ad8e4b75c8a7bed475d72ce09bf526718862196

We have not verified if this issue affects RHEL4.

Comment 2 David Miller 2006-01-11 23:39:26 UTC

Not relevant to any of our products, as the cleanup that introduced this
bug is not in any of our trees.

Comment 3 Mark J. Cox 2006-01-12 10:11:18 UTC

Confirmed, commit of vulnerable code 20051110 therefore only affected 2.6.14+;
submitted clarfication to CVE project.