APPLIED: [CVE-2010-4251/CVE-2010-4805] socket backlog handling

[Tim Gardner]

On 07/22/2011 10:42 AM, Andy Whitcroft wrote:
> CVE-2010-4251
> 	The socket implementation in net/core/sock.c in the Linux kernel
> 	before 2.6.34 does not properly manage a backlog of received
> 	packets, which allows remote attackers to cause a denial of service
> 	(memory consumption) by sending a large amount of network traffic,
> 	as demonstrated by netperf UDP tests.
>
> CVE-2010-4805
> 	The socket implementation in net/core/sock.c in the Linux kernel
> 	before 2.6.35 does not properly manage a backlog of received
> 	packets, which allows remote attackers to cause a denial of
> 	service by sending a large amount of network traffic, related
> 	to the sk_add_backlog function and the sk_rmem_alloc socket
> 	field. NOTE: this vulnerability exists because of an incomplete
> 	fix for CVE-2010-4251.
>
> The fixes for these two CVEs have already hit most of the other branches.
> Following this email is a heap of patches which are direct cherry-picks
> from those that were acked and applied to the lucid master branch.
>
> Proposing for lucid/fsl-imx51.
>
> -apw
>


-- 
Tim Gardner tim.gardner at canonical.com