Bug 177500

Summary:	CVE-2006-0035 netlink DoS (ipf)
Product:	Red Hat Enterprise Linux 2.1	Reporter:	Mark J. Cox <mjc>
Component:	kernel	Assignee:	Don Howard <dhoward>
Status:	CLOSED NOTABUG	QA Contact:	Brian Brock <bbrock>
Severity:	high	Docs Contact:
Priority:	medium
Version:	2.1	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	ia64
OS:	Linux
Whiteboard:	reported=20060109,public=2006010:2102,impact=important,source=kernel
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-01-12 00:49:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mark J. Cox 2006-01-11 10:27:19 UTC

NOTE: We have not verified if this issue affects RHEL2.1, see private reproducer
in #177496

+++ This bug was initially created as a clone of Bug #177496 +++

A netlink message with nlmsg_len set to 0 can cause an infinite loop holding the
netlink semaphore therefore allowing a local unprivileged DoS.

Here is the upstream fix for this issue:

http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ad8e4b75c8a7bed475d72ce09bf526718862196

Comment 1 Don Howard 2006-01-12 00:49:21 UTC

This patch above does not appear to apply to any redhat trees.
I was unable to reproduce the report on derry.