Bug 696029 (CVE-2011-1581)

Summary: CVE-2011-1581 kernel: bonding: Incorrect TX queue offset
Product: [Other] Security Response Reporter: Eugene Teo (Security Response) <eteo>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: arozansk, davej, dhoward, kernel-mgr, kmcmartin, lwang, pmatouse, sforsber, tcallawa
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-03-28 08:42:54 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 695548, 696030    
Bug Blocks:    

Description Eugene Teo (Security Response) 2011-04-13 05:46:23 UTC 
Backport of upstream commit:
fd0e435b0fe85622f167b84432552885a4856ac8 bonding: Incorrect TX queue offset

By default bonding only allocates 16 queues.  This patch will prevent devices that have more than 16 receive queues (82599 has 128) from blowing out the tx queue index for the bonding device.

For proper queue allocation, in the bonding driver and down to the devices, they should probably add the following line to one of the files in /etc/modprobe.d/

options bonding tx_queues=N

where N>= number of processors that show up in /proc/cpuinfo.
Comment 3 Eugene Teo (Security Response) 2011-04-13 05:59:14 UTC 
Statement:

This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 4, 5, and Red Hat Enterprise MRG as they did not backport the upstream commit bb1d9123 that introduced this issue. A future kernel update in Red Hat Enterprise Linux 6 may address this flaw.
Comment 5 errata-xmlrpc 2011-05-19 11:58:37 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0542 https://rhn.redhat.com/errata/RHSA-2011-0542.html
Comment 6 errata-xmlrpc 2011-05-23 20:54:26 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0542 https://rhn.redhat.com/errata/RHSA-2011-0542.html