Description of problem: Eugene Teo reported that an integer overflow flaw was found in the Linux kernel dccp_setsockopt_change() function. The vulnerability exists due to a lack of sanitisation performed on a user-controlled integer value before the value is employed as the size argument of a memory allocation operation. An attacker may leverage this vulnerability to trigger a kernel panic on a victim's machine remotely.
Proposed upstream patch: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=3e8a0a559c66ee9e7468195691a56fefc3589740
Created attachment 314378 [details] Upstream patch for this issue
Created attachment 314606 [details] Proposed backported patch for MRG kernel
On Red Hat Enterprise Linux 5, SELinux denies access requested by default: type=AVC msg=audit(1217928226.398:41): avc: denied { create } for pid=4974 comm="server" scontext=user_u:system_r:unconfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=dccp_socket type=SYSCALL msg=audit(1217928226.398:41): arch=c000003e syscall=41 success=no exit=-13 a0=2 a1=6 a2=21 a3=0 items=0 ppid=3599 pid=4974 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=1 comm="server" exe="/home/test/dccp-CVE-2008-3276/server" subj=user_u:system_r:unconfined_t:s0 key=(null) socket(PF_INET, 0x6 /* SOCK_??? */, 0x21 /* IPPROTO_??? */) = -1 EACCES (Permission denied)
Patch queued for -78
Verified. Found both proposed and backported patch as mrg-rt.git commit 3e1ad8433fc1b6ca4eafd4b8b349ea88ef135fd2. Disabled SELinux and run reproducer on 2.6.24.7-74rt and 2.6.24.7-81rt kernels. Kernel crashed on -74rt and gave "setsockopt: Invalid argument" as error on -81rt.
This was addressed via: MRG Realtime for RHEL 5 Server (RHSA-2008:0857) Red Hat Enterprise Linux version 5 (RHSA-2008:0957)