Bug 664914 (CVE-2010-4526)
| Summary: | CVE-2010-4526 kernel: sctp: a race between ICMP protocol unreachable and connect() | |||
|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Eugene Teo (Security Response) <eteo> | |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | |
| Status: | CLOSED ERRATA | QA Contact: | ||
| Severity: | high | Docs Contact: | ||
| Priority: | high | |||
| Version: | unspecified | CC: | bressers, dhoward, jburke, jkacur, jlieskov, jpirko, kzhang, lgoncalv, lsmid, lwang, nhorman, plyons, pmatouse, rmitchel, security-response-team, sgrubb, syeghiay, williams, wmealing | |
| Target Milestone: | --- | Keywords: | Security | |
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 744053 (view as bug list) | Environment: | ||
| Last Closed: | 2014-09-23 04:23:07 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 665476, 665477, 667028, 667029, 667030, 745263 | |||
| Bug Blocks: | 744053 | |||
|
Description
Eugene Teo (Security Response)
2010-12-22 05:23:32 UTC
Upstream commit: http://git.kernel.org/linus/50b5d6ad63821cea324a5a7a19854d4de1a0a819 commit 50b5d6ad63821cea324a5a7a19854d4de1a0a819 Author: Vlad Yasevich <vladislav.yasevich> Date: Thu May 6 00:56:07 2010 -0700 sctp: Fix a race between ICMP protocol unreachable and connect() ICMP protocol unreachable handling completely disregarded the fact that the user may have locked the socket. It proceeded to destroy the association, even though the user may have held the lock and had a ref on the association. [...] This was because the sctp_wait_for_connect() would aqcure the socket lock and then proceed to release the last reference count on the association, thus cause the fully destruction path to finish freeing the socket. The simplest solution is to start a very short timer in case the socket is owned by user. When the timer expires, we can do some verification and be able to do the release properly. Signed-off-by: Vlad Yasevich <vladislav.yasevich> Signed-off-by: David S. Miller <davem> Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 4 did not include upstream commit history:5aabd1fe268e850c2e93048a5ccc5eb6970ac49c, and therefore is not affected by this issue. This has been addressed in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG via http://rhn.redhat.com/errata/RHSA-2011-0163.html, https://rhn.redhat.com/errata/RHSA-2011-0421.html and https://rhn.redhat.com/errata/RHSA-2011-1253.html. This issue has been addressed in following products: Red Hat Enterprise Linux 5.6.Z Via RHSA-2011:0163 https://rhn.redhat.com/errata/RHSA-2011-0163.html This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2011:0421 https://rhn.redhat.com/errata/RHSA-2011-0421.html This issue has been addressed in following products: MRG for RHEL-6 v.2 Via RHSA-2011:1253 https://rhn.redhat.com/errata/RHSA-2011-1253.html |