Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 529137 - (CVE-2009-3613) CVE-2009-3613 kernel: flood ping cause out-of-iommu error and panic when mtu larger than 1500
CVE-2009-3613 kernel: flood ping cause out-of-iommu error and panic when mtu ...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,reported=20091015,pu...
: Security
Depends On: 515857 529139 529140 529141 529142 529143 537295
Blocks:
  Show dependency treegraph
 
Reported: 2009-10-15 01:57 EDT by Eugene Teo (Security Response)
Modified: 2012-03-28 04:52 EDT (History)
15 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-03-28 04:52:14 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:1540 normal SHIPPED_LIVE Important: kernel-rt security, bug fix, and enhancement update 2009-11-03 13:21:07 EST
Red Hat Product Errata RHSA-2009:1548 normal SHIPPED_LIVE Important: kernel security and bug fix update 2009-11-03 14:33:33 EST
Red Hat Product Errata RHSA-2009:1671 normal SHIPPED_LIVE Important: kernel security and bug fix update 2009-12-15 12:18:22 EST
Red Hat Product Errata RHSA-2009:1692 normal SHIPPED_LIVE Important: rhev-hypervisor security and bug fix update 2009-12-23 09:05:01 EST

  None (edit)
Description Eugene Teo (Security Response) 2009-10-15 01:57:18 EDT
Description of problem:
(description copied from bug 515857).

The hardware condition is the same as bz504732 described: 2 machines and a switch supporting jumbo frames(actually we didn't use a switch but a coaxial-cable). The pingee has a rtl8169 NIC.

I configure MTU of both machine, the pinger is set to 9000 and the pingee is set to 7200.

Then I execute flood ping from the pinger to pingee by execute ping -f -s 3000 <pingee's IP>, few seconds later the pingee crashed.

Crash doesn't occur when using ping -f <pingee's IP> (i.e. don't send large packets).

Version-Release number of selected component (if applicable):

rhel-5.4 with kernel-2.6.18-160.el5

How reproducible:

as described above.

Actual results:

few seconds after executing ping -f -s 3000, the pingee gives out the error message, then crashes:

PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0
PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0
<Repeated Many Many Times>
PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0
PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0

HARDWARE ERROR
CPU 0: Machine Check Exception:                7 Bank 4: bc0000000005001b
RIP 10:<ffffffff8006b2b0> {default_idle+0x29/0x50}
TSC 10116da2355 ADDR 4000000 MISC c008000001000000 
This is not a software problem!
Run through mcelog --ascii to decode and contact your hardware vendor
Kernel panic - not syncing: Uncorrected machine check
 <7>APIC error on CPU2: 00(08)

the pinger prints dots on screen(since no reply received) repeatedly.

Expected results:

the pingee doesn't crash, or the pingee refuses the flood ping(since flood ping usually used as a kind of DoS attack).

Additional info:
Comment 3 Chuck Ebbert 2009-10-16 05:03:31 EDT
Fedora is not vulnerable. The first commit is already in 2.6 27 and the second is in 2.6.27.22.
Comment 4 Jan Lieskovsky 2009-10-20 04:50:58 EDT
MITRE's CVE-2009-3613 record:
-----------------------------

The swiotlb functionality in the r8169 driver in drivers/net/r8169.c
in the Linux kernel before 2.6.27.22 allows remote attackers to cause
a denial of service (IOMMU space exhaustion and system crash) by using
jumbo frames for a large amount of network traffic, as demonstrated by
a flood ping.

References:
-----------
http://bugzilla.kernel.org/show_bug.cgi?id=9468
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=97d477a914b146e7e6722ded21afa79886ae8ccd
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a866bbf6aacf95f849810079442a20be118ce905
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.22
Comment 6 errata-xmlrpc 2009-11-03 13:21:40 EST
This issue has been addressed in following products:

  MRG for RHEL-5

Via RHSA-2009:1540 https://rhn.redhat.com/errata/RHSA-2009-1540.html
Comment 7 errata-xmlrpc 2009-11-03 14:33:54 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1548 https://rhn.redhat.com/errata/RHSA-2009-1548.html
Comment 9 errata-xmlrpc 2009-12-15 12:18:33 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2009:1671 https://rhn.redhat.com/errata/RHSA-2009-1671.html
Comment 10 Keith Wilkinson 2009-12-18 07:50:08 EST
(In reply to comment #3)
> Fedora is not vulnerable. The first commit is already in 2.6 27 and the second
> is in 2.6.27.22.  

Related to 504726?
Comment 11 errata-xmlrpc 2009-12-23 09:05:03 EST
This issue has been addressed in following products:

  Red Hat Enterprise Virtualization for RHEL-5

Via RHSA-2009:1692 https://rhn.redhat.com/errata/RHSA-2009-1692.html

Note You need to log in before you can comment on or make changes to this bug.