Bug 529137 (CVE-2009-3613) - CVE-2009-3613 kernel: flood ping cause out-of-iommu error and panic when mtu larger than 1500
Summary: CVE-2009-3613 kernel: flood ping cause out-of-iommu error and panic when mtu ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2009-3613
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 515857 529139 529140 529141 529142 529143 537295
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-10-15 05:57 UTC by Eugene Teo (Security Response)
Modified: 2019-09-29 12:32 UTC (History)
15 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-03-28 08:52:14 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:1540 0 normal SHIPPED_LIVE Important: kernel-rt security, bug fix, and enhancement update 2009-11-03 18:21:07 UTC
Red Hat Product Errata RHSA-2009:1548 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2009-11-03 19:33:33 UTC
Red Hat Product Errata RHSA-2009:1671 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2009-12-15 17:18:22 UTC
Red Hat Product Errata RHSA-2009:1692 0 normal SHIPPED_LIVE Important: rhev-hypervisor security and bug fix update 2009-12-23 14:05:01 UTC

Description Eugene Teo (Security Response) 2009-10-15 05:57:18 UTC
Description of problem:
(description copied from bug 515857).

The hardware condition is the same as bz504732 described: 2 machines and a switch supporting jumbo frames(actually we didn't use a switch but a coaxial-cable). The pingee has a rtl8169 NIC.

I configure MTU of both machine, the pinger is set to 9000 and the pingee is set to 7200.

Then I execute flood ping from the pinger to pingee by execute ping -f -s 3000 <pingee's IP>, few seconds later the pingee crashed.

Crash doesn't occur when using ping -f <pingee's IP> (i.e. don't send large packets).

Version-Release number of selected component (if applicable):

rhel-5.4 with kernel-2.6.18-160.el5

How reproducible:

as described above.

Actual results:

few seconds after executing ping -f -s 3000, the pingee gives out the error message, then crashes:

PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0
PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0
<Repeated Many Many Times>
PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0
PCI-DMA: Out of IOMMU space for 7222 bytes at device 0000:03:00.0

HARDWARE ERROR
CPU 0: Machine Check Exception:                7 Bank 4: bc0000000005001b
RIP 10:<ffffffff8006b2b0> {default_idle+0x29/0x50}
TSC 10116da2355 ADDR 4000000 MISC c008000001000000 
This is not a software problem!
Run through mcelog --ascii to decode and contact your hardware vendor
Kernel panic - not syncing: Uncorrected machine check
 <7>APIC error on CPU2: 00(08)

the pinger prints dots on screen(since no reply received) repeatedly.

Expected results:

the pingee doesn't crash, or the pingee refuses the flood ping(since flood ping usually used as a kind of DoS attack).

Additional info:

Comment 3 Chuck Ebbert 2009-10-16 09:03:31 UTC
Fedora is not vulnerable. The first commit is already in 2.6 27 and the second is in 2.6.27.22.

Comment 4 Jan Lieskovsky 2009-10-20 08:50:58 UTC
MITRE's CVE-2009-3613 record:
-----------------------------

The swiotlb functionality in the r8169 driver in drivers/net/r8169.c
in the Linux kernel before 2.6.27.22 allows remote attackers to cause
a denial of service (IOMMU space exhaustion and system crash) by using
jumbo frames for a large amount of network traffic, as demonstrated by
a flood ping.

References:
-----------
http://bugzilla.kernel.org/show_bug.cgi?id=9468
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=97d477a914b146e7e6722ded21afa79886ae8ccd
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a866bbf6aacf95f849810079442a20be118ce905
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.22

Comment 6 errata-xmlrpc 2009-11-03 18:21:40 UTC
This issue has been addressed in following products:

  MRG for RHEL-5

Via RHSA-2009:1540 https://rhn.redhat.com/errata/RHSA-2009-1540.html

Comment 7 errata-xmlrpc 2009-11-03 19:33:54 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1548 https://rhn.redhat.com/errata/RHSA-2009-1548.html

Comment 9 errata-xmlrpc 2009-12-15 17:18:33 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2009:1671 https://rhn.redhat.com/errata/RHSA-2009-1671.html

Comment 10 Keith Wilkinson 2009-12-18 12:50:08 UTC
(In reply to comment #3)
> Fedora is not vulnerable. The first commit is already in 2.6 27 and the second
> is in 2.6.27.22.  

Related to 504726?

Comment 11 errata-xmlrpc 2009-12-23 14:05:03 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Virtualization for RHEL-5

Via RHSA-2009:1692 https://rhn.redhat.com/errata/RHSA-2009-1692.html


Note You need to log in before you can comment on or make changes to this bug.