Bug 752304 (CVE-2012-1583)

Summary:	CVE-2012-1583 kernel: ipv6: panic using raw sockets
Product:	[Other] Security Response	Reporter:	Eugene Teo (Security Response) <eteo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	agordeev, agospoda, anton, bressers, cdahlin, dhoward, fhrbata, fleitner, haliu, kernel-mgr, lwang, plougher, pmatouse, rchidamb, security-response-team, sforsber, sparks
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-06-02 18:44:31 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	743375, 752305, 806943, 806944, 806945, 808290, 816270, 818871, 818872, 818873
Bug Blocks:	752303, 823418

Description Eugene Teo (Security Response) 2011-11-09 06:05:16 UTC

The bug is caused by sk_buff double free and cannot be triggered without xfrm6_tunnel module loaded. If you do not need to use the xfrm6_tunnel module, you can choose to blacklist it.

Comment 7 Eugene Teo (Security Response) 2012-03-30 04:24:43 UTC

Upstream commit:

http://git.kernel.org/linus/d0772b70 (v2.6.22-rc1)


Statement:

This issue did not affect the Linux kernel as shipped with Red Hat Enterprise Linux 6, and Red Hat Enterprise MRG. This has been addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2012-0480.html. A future kernel update for Red Hat Enterprise Linux 4 may address this issue.

Comment 12 Eugene Teo (Security Response) 2012-04-13 04:27:20 UTC

If you do not run applications that use xfrm6_tunnel, you can prevent the
xfrm6_tunnel module from being loaded by creating (as the root user) a
"/etc/modprobe.d/xfrm6_tunnel.conf" file, and adding the following line to it:

blacklist xfrm6_tunnel

This way, the xfrm6_tunnel module cannot be loaded accidentally. A reboot is not necessary for this change to take effect.

Comment 14 errata-xmlrpc 2012-04-17 17:54:20 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:0480 https://rhn.redhat.com/errata/RHSA-2012-0480.html

Comment 17 Eugene Teo (Security Response) 2012-05-04 08:52:58 UTC

Created kernel tracking bugs for this issue

Affects: fedora-all [bug 818873]

Comment 18 errata-xmlrpc 2012-06-12 14:55:54 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5.6 EUS - Server Only

Via RHSA-2012:0720 https://rhn.redhat.com/errata/RHSA-2012-0720.html