Bug 912900 (CVE-2013-0310)

Summary: CVE-2013-0310 kernel: net: CIPSO_V4_TAG_LOCAL tag NULL pointer dereference
Product: [Other] Security Response Reporter: Petr Matousek <pmatouse>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: agordeev, bhu, dhoward, fhrbata, gansalmon, iboverma, itamar, jforbes, jkacur, jneedle, jonathan, jwboyer, kernel-maint, kernel-mgr, lgoncalv, lwang, madhu.chinakonda, mcressma, nobody, plougher, rt-maint, rvrbovsk, sforsber, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20130219,reported=20130219,source=redhat,cvss2=4.4/AV:L/AC:M/Au:S/C:N/I:N/A:C,rhel-5/kernel=notaffected,rhel-6/kernel=affected,mrg-2/realtime-kernel=notaffected,fedora-all/kernel=notaffected,cwe=CWE-476[auto]
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-07-29 09:09:12 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 842872    
Bug Blocks:    

Description Petr Matousek 2013-02-19 19:08:47 EST
The skb argument to cipso_v4_validate() is NULL when called via the setsockopt() syscall. An local user able to set CIPSO IP options on the socket could use this flaw to crash the system.

Upstream fix:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=89d7ae34cdda4195809a5a987f697a517a2a3177
Comment 1 Petr Matousek 2013-02-19 19:49:06 EST
Statement:

This issue did affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 6.

This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG 2.
Comment 2 errata-xmlrpc 2013-02-21 02:03:37 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:0496 https://rhn.redhat.com/errata/RHSA-2013-0496.html