Hide Forgot
We check tid->sched without a lock taken on ath_tx_aggr_sleep(). That is race condition which can result of doing list_del(&tid->list) twice (second time with poisoned list node) and causing a crash. Upstream fixes: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=21f8aaee0c62708654988ce092838aa7df4d25d8 References: http://seclists.org/oss-sec/2014/q1/701
Statement: This issued does not affect Red Hat Enterprise Linux 5 because we do not provide support for Atheros 9k wireless network adapters.
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1083253]
This issue has been addressed in following products: MRG for RHEL-6 v.2 Via RHSA-2014:0557 https://rhn.redhat.com/errata/RHSA-2014-0557.html
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2014:0981 https://rhn.redhat.com/errata/RHSA-2014-0981.html
IssueDescription: It was found that a remote attacker could use a race condition flaw in the ath_tx_aggr_sleep() function to crash the system by creating large network traffic on the system's Atheros 9k wireless network adapter.
This issue has been addressed in following products: Red Hat Enterprise Linux 7 Via RHSA-2014:1023 https://rhn.redhat.com/errata/RHSA-2014-1023.html
This issue has been addressed in following products: Red Hat Enterprise Linux 6.4 EUS - Server and Compute Node Only Via RHSA-2014:1101 https://rhn.redhat.com/errata/RHSA-2014-1101.html