Bug 521601 (CVE-2005-4881) - CVE-2005-4881 kernel: netlink: fix numerous padding memleaks
Summary: CVE-2005-4881 kernel: netlink: fix numerous padding memleaks
Keywords:
Status: NEW
Alias: CVE-2005-4881
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,reported=20090907,pub...
Depends On: 521602 521603
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-09-07 08:39 UTC by Eugene Teo (Security Response)
Modified: 2019-06-08 12:49 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:1522 normal SHIPPED_LIVE Moderate: kernel security and bug fix update 2009-10-22 15:09:25 UTC

Description Eugene Teo (Security Response) 2009-09-07 08:39:21 UTC
Description of problem:
Fix numerous padding memleaks.

Missing initialization in dumped data
http://git.kernel.org/linus/9ef1d4c7c7aca1cd436612b6ca785b726ffb8ed8

Clear padding in netlink messages
http://git.kernel.org/linus/b3563c4fbff906991a1b4ef4609f99cca2a0de6a

Missing padding fields in dumped structures
http://git.kernel.org/linus/8a47077a0b5aa2649751c46e7a27884e6686ccbf

Comment 4 Jan Lieskovsky 2009-10-20 08:42:58 UTC
MITRE's CVE-2005-4881 record:
-----------------------------

The netlink subsystem in the Linux kernel 2.4.x before 2.4.37.6 and
2.6.x before 2.6.13-rc1 does not initialize certain padding fields in
structures, which might allow local users to obtain sensitive
information from kernel memory via unspecified vectors, related to the
(1) tc_fill_qdisc, (2) tcf_fill_node, (3) neightbl_fill_info, (4)
neightbl_fill_param_info, (5) neigh_fill_info, (6)
rtnetlink_fill_ifinfo, (7) rtnetlink_fill_iwinfo, (8) vif_delete, (9)
ipmr_destroy_unres, (10) ipmr_cache_alloc_unres, (11)
ipmr_cache_resolve, (12) inet6_fill_ifinfo, (13) tca_get_fill, (14)
tca_action_flush, (15) tcf_add_notify, (16) tc_dump_action, (17)
cbq_dump_police, (18) __nlmsg_put, (19) __rta_fill, (20)
__rta_reserve, (21) inet6_fill_prefix, (22) rsvp_dump, and (23)
cbq_dump_ovl functions.

References:
-----------
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git;a=commit;h=0f3f2328f63c521fe4b435f148687452f98b2349
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git;a=commit;h=30e744716c4a6cc4e8ecaaddf68f20057c03dc8d
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git;a=commit;h=3408cce0c2f380884070896420ca566704452fb5
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8a47077a0b5aa2649751c46e7a27884e6686ccbf
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9ef1d4c7c7aca1cd436612b6ca785b726ffb8ed8
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b3563c4fbff906991a1b4ef4609f99cca2a0de6a
http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.6
http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.13/ChangeLog-2.6.13-rc1

Comment 5 errata-xmlrpc 2009-10-22 15:09:33 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2009:1522 https://rhn.redhat.com/errata/RHSA-2009-1522.html


Note You need to log in before you can comment on or make changes to this bug.