Description of problem: (description copied from bug 515857). The hardware condition is the same as bz504732 described: 2 machines and a switch supporting jumbo frames(actually we didn't use a switch but a coaxial-cable). The pingee has a rtl8169 NIC. I configure MTU of both machine, the pinger is set to 9000 and the pingee is set to 7200. Then I execute flood ping from the pinger to pingee by execute ping -f -s 3000 <pingee's IP>, few seconds later the pingee crashed. Crash doesn't occur when using ping -f <pingee's IP> (i.e. don't send large packets). Version-Release number of selected component (if applicable): rhel-5.4 with kernel-2.6.18-160.el5 How reproducible: as described above. Actual results: few seconds after executing ping -f -s 3000, the pingee gives out the error message, then crashes: PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0 PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0 <Repeated Many Many Times> PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0 PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0 HARDWARE ERROR CPU 0: Machine Check Exception: 7 Bank 4: bc0000000005001b RIP 10:<ffffffff8006b2b0> {default_idle+0x29/0x50} TSC 10116da2355 ADDR 4000000 MISC c008000001000000 This is not a software problem! Run through mcelog --ascii to decode and contact your hardware vendor Kernel panic - not syncing: Uncorrected machine check <7>APIC error on CPU2: 00(08) the pinger prints dots on screen(since no reply received) repeatedly. Expected results: the pingee doesn't crash, or the pingee refuses the flood ping(since flood ping usually used as a kind of DoS attack). Additional info:
Upstream bug report: http://bugzilla.kernel.org/show_bug.cgi?id=9468 Upstream commits: http://git.kernel.org/linus/a866bbf6aacf95f849810079442a20be118ce905 http://git.kernel.org/linus/97d477a914b146e7e6722ded21afa79886ae8ccd
Fedora is not vulnerable. The first commit is already in 2.6 27 and the second is in 2.6.27.22.
MITRE's CVE-2009-3613 record: ----------------------------- The swiotlb functionality in the r8169 driver in drivers/net/r8169.c in the Linux kernel before 2.6.27.22 allows remote attackers to cause a denial of service (IOMMU space exhaustion and system crash) by using jumbo frames for a large amount of network traffic, as demonstrated by a flood ping. References: ----------- http://bugzilla.kernel.org/show_bug.cgi?id=9468 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=97d477a914b146e7e6722ded21afa79886ae8ccd http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a866bbf6aacf95f849810079442a20be118ce905 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.22
This issue has been addressed in following products: MRG for RHEL-5 Via RHSA-2009:1540 https://rhn.redhat.com/errata/RHSA-2009-1540.html
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2009:1548 https://rhn.redhat.com/errata/RHSA-2009-1548.html
This issue has been addressed in following products: Red Hat Enterprise Linux 4 Via RHSA-2009:1671 https://rhn.redhat.com/errata/RHSA-2009-1671.html
(In reply to comment #3) > Fedora is not vulnerable. The first commit is already in 2.6 27 and the second > is in 2.6.27.22. Related to 504726?
This issue has been addressed in following products: Red Hat Enterprise Virtualization for RHEL-5 Via RHSA-2009:1692 https://rhn.redhat.com/errata/RHSA-2009-1692.html