A temporary denial of service flaw was found in radvd's process_rs() function, where it would call mdelay() on the same thread in which it handled all input. If ->UnicastOnly were set, an attacker could cause a flood with ND_ROUTER_SOLICIT and fill the input queue of the daemon. This would cause a brief outage of approximately MAX_RA_DELAY_TIME / 2 * sizeof_input_queue when handling new clients, where MAX_RA_DELAY_TIME is 500ms, leading to delays of more than a minute. Note: this is only the case in unicast-only mode; there is no denial of service in the (normal, default) anycast mode. (CVE-2011-3605) This is corrected in upstream git [1]. [1] https://github.com/reubenhwk/radvd/commit/2591d0189257caeaae2057dfed0a260310497a61 Acknowledgements: Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.
This issue affects the version of radvd as shipped with Red Hat Enterprise Linux 4, 5 and 6. This issue affects the version of radvd as shipped with Fedora 14 and 15.
Public via: http://thread.gmane.org/gmane.comp.security.oss.general/5973
Created radvd tracking bugs for this issue Affects: fedora-all [bug 744116]
radvd-1.8.2-2.fc15 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report.
radvd-1.8.2-2.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report.
radvd-1.8.2-2.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.