Bug 208393
Summary: | CVE-2006-4572 IPv6/IP6Tables Vulnerabilities | ||
---|---|---|---|
Product: | Red Hat Enterprise Linux 2.1 | Reporter: | Marcel Holtmann <holtmann> |
Component: | kernel | Assignee: | Don Howard <dhoward> |
Status: | CLOSED NOTABUG | QA Contact: | Brian Brock <bbrock> |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | 2.1 | CC: | security-response-team |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | ia64 | ||
OS: | Linux | ||
Whiteboard: | impact=important,source=kernelsec,reported=20060928,public=20061025 | ||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2006-10-02 12:49:55 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Marcel Holtmann
2006-09-28 11:03:28 UTC
The function ipv6_find_hdr() was first introduced with 2.6.14-rc2 and later updated with 2.6.16-rc1. The code in question before 2.6.14 and so also in the RHEL2.1 kernel looks like this: /* look for the desired protocol header */ if((ip6info->flags & IP6T_F_PROTO)) { u_int8_t currenthdr = ipv6->nexthdr; u_int8_t *hdrptr; hdrptr = (u_int8_t *)(ipv6 + 1); do { if (ip6info->proto == currenthdr) { if(ip6info->invflags & IP6T_INV_PROTO) return 0; return 1; } currenthdr = ip6_nexthdr(currenthdr, hdrptr); } while(currenthdr); if (!(ip6info->invflags & IP6T_INV_PROTO)) return 0; } The attack talks about circumventing the possibly installed DROP rule and make the function return a non-match. RHEL2.1 doesn't seem to be affected to the fragment rule workaround. |