Bug 723429 (CVE-2011-2699) - CVE-2011-2699 kernel: ipv6: make fragment identifications less predictable
Summary: CVE-2011-2699 kernel: ipv6: make fragment identifications less predictable
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2011-2699
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: Engineering723430 Engineering723431 Engineering723432 Engineering723433 Engineering723434 748667 Engineering761356 Engineering773543
Blocks: Embargoed717530
TreeView+ depends on / blocked
 
Reported: 2011-07-20 06:54 UTC by Eugene Teo (Security Response)
Modified: 2023-05-11 17:57 UTC (History)
22 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-05-10 08:13:31 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:1386 0 normal SHIPPED_LIVE Important: kernel security, bug fix, and enhancement update 2011-10-20 17:28:15 UTC
Red Hat Product Errata RHSA-2011:1465 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2011-11-22 21:45:37 UTC
Red Hat Product Errata RHSA-2012:0358 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2012-03-06 22:42:05 UTC

Description Eugene Teo (Security Response) 2011-07-20 06:54:53 UTC 
IPv6 fragment identification generation is way beyond what we use for IPv4 : It uses a single generator. Its not scalable and allows DOS attacks.

Now inetpeer is IPv6 aware, we can use it to provide a more secure and scalable frag ident generator (per destination, instead of system wide)

This patch :
1) defines a new secure_ipv6_id() helper
2) extends inet_getid() to provide 32bit results
3) extends ipv6_select_ident() with a new dest parameter

http://thread.gmane.org/gmane.linux.network/201773

Acknowledgements:

Red Hat would like to thank Fernando Gont for reporting this issue.
Comment 7 Petr Matousek 2011-07-20 10:06:47 UTC 
Statement:

This issue did not affect the Linux kernel as shipped with Red Hat Enterprise MRG as it has backported the fix that addresses this issue. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates. This has been addressed in Red Hat Enterprise Linux 5 and 6 via https://rhn.redhat.com/errata/RHSA-2011-1386.html and https://rhn.redhat.com/errata/RHSA-2011-1465.html.
Comment 9 Eugene Teo (Security Response) 2011-07-26 09:00:50 UTC 
Upstream commit:
http://git.kernel.org/linus/87c48fa3b4630905f98268dde838ee43626a060c
Comment 11 Eugene Teo (Security Response) 2011-08-24 05:11:11 UTC 
(In reply to comment #9)
> Upstream commit:
> http://git.kernel.org/linus/87c48fa3b4630905f98268dde838ee43626a060c

I believe this is the one we want to backport; http://permalink.gmane.org/gmane.linux.kernel.stable/16086
Comment 13 Jiri Pirko 2011-08-27 07:51:26 UTC 
http://git.kernel.org/?p=linux/kernel/git/stable/linux-3.0.y.git;a=commitdiff;h=ef81bb40bf15f350fe865f31fa42f1082772a576
Comment 16 errata-xmlrpc 2011-10-20 17:28:27 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:1386 https://rhn.redhat.com/errata/RHSA-2011-1386.html
Comment 17 Eugene Teo (Security Response) 2011-10-25 03:33:26 UTC 
Created kernel tracking bugs for this issue

Affects: fedora-all [bug 748667]
Comment 19 errata-xmlrpc 2011-11-22 16:49:44 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:1465 https://rhn.redhat.com/errata/RHSA-2011-1465.html
Comment 22 errata-xmlrpc 2012-03-06 17:43:31 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5.6 EUS - Server Only

Via RHSA-2012:0358 https://rhn.redhat.com/errata/RHSA-2012-0358.html
Note You need to log in before you can comment on or make changes to this bug.