<!-- SBZ_reproduce  -->
the mail contains a sample crash program.

Created attachment 26456 [details]
mail.txt

Need fix :/

CAN-2004-1016 
 
not public yet. 
 
I think, net/ipv4/ip_sockglue.c::ip_cmsg_send() needs 
a more sensible check that we do not loop back to an old cmsg header. 
 
lets see if vendor-sec brings something up. 

the problem seems that it can go into an endless loop. so very easy local 
denial of service. 

Created attachment 26520 [details]
2.6 patch from Herbert Xu

Resent-Message-Id: <200411291228.iATCSi8X031567@verein.lst.de>
To: "David S. Miller" <davem@davemloft.net>
Cc: vendor-sec <vendor-sec@lst.de>, Paul Starzetz <ihaquer@isec.pl>,
	Mark J Cox <mjc@redhat.com>, security@isec.pl,
	Martin Pitt <martin.pitt@canonical.com>
Subject: Re: [vendor-sec] Linux kernel <= 2.4.28 DoS
User-Agent: Mutt/1.5.6+20040722i
From: Herbert Xu <herbert@gondor.apana.org.au>
Errors-To: vendor-sec-admin@lst.de
Date: Sat, 27 Nov 2004 12:15:00 +1100

On Thu, 25 Nov 2004, Parul Starzetz wrote:
>
> below a non privileged version of your favourite setuid /sbin/halt=20
> command. On SMP machines you may need to start it few times.

Thanks for the program Paul.

This patch should fix the cmsg_len checking for 2.6.  A 2.4 backport
should be straightforward.

BTW, preempt will mitigate the effects of this particular attack.
However, there may well be other ways to exploit this through the
messages themselves.

Cheers,

not yet disclosed! 
 
patch should be reviewed, might not be final yet. 
 
ccing networking guru ak too. 

The patch look sane. 

is now public. (in bitkeeper = public) 

patch is in, marcus -> tracking 

updates and advisory released.

CVE-2004-1016: CVSS v2 Base Score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)