Re: [patch 0/8 2.6.32] CVE-2010-4251: packet backlog can get too large

[Ben Hutchings <ben@decadent.org.uk>]

[-- Attachment #1: Type: text/plain, Size: 1884 bytes --]

On Sun, 2011-11-13 at 15:58 -0500, David Miller wrote:
> From: Dan Carpenter <dan.carpenter@oracle.com>
> Date: Sun, 13 Nov 2011 23:13:36 +0300
> 
> > This patch series is to address CVE-2010-4251 for the 2.6.32 stable
> > kernel.  Here is the CVE summary:
> > 
> >  "The socket implementation in net/core/sock.c in the Linux kernel
> >   before 2.6.34 does not properly manage a backlog of received
> >   packets, which allows remote attackers to cause a denial of service
> >   (memory consumption) by sending a large amount of network traffic,
> >   as demonstrated by netperf UDP tests."
> > 
> > [patch 1/8] introduces sk_add_backlog_limited()
> > [patch 2-7/8] change each network protocol to use sk_add_backlog_limited()
> > 	where appropriate.
> > [patch 8/8] renames sk_add_backlog() to __sk_add_backlog() and
> > 	sk_add_backlog_limited() to sk_add_backlog().
> > 
> > The patches mostly apply without changes.  The exception is:
> > [patch 2/8] udp: use limited socket backlog
> > Then the rename [patch 8/8] needed to be changed as well to match.
> 
> These changes are way too intrusive and potentially regression
> inducing for -stable inclusion, especially a kernel that is in such
> deep maintainence mode as 2.6.32 is.

Debian 6.0 based on Linux 2.6.32 has patches #1-7, except our backport
of #2 (for udp) looks a bit different.

Apparently several other distributions have also applied these.

> Also, I tend to personally submit networking -stable patches, so please
> do not bypass me in this manner and instead recommend such submissions
> on the netdev list so I can evaluate the request.

But you've previously said that you are not submitting networking
patches to the longterm series.  Did you change your mind?

Ben.

-- 
Ben Hutchings
Never attribute to conspiracy what can adequately be explained by stupidity.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]