Linux Kernel 2.6.38 Remote NULL Pointer Dereference May 16 2011 12:51PM
roberto paleari emaze net
Linux Kernel 2.6.38 Remote NULL Pointer Dereference


[Advisory Information]

Title: Linux kernel 2.6.38: Remote NULL pointer dereference

Release date: 11/05/2011

Last update: 11/05/2011


Aristide Fattori, Università degli Studi di Milano (joystick (at) security.dico.unimi (dot) it [email concealed])

Roberto Paleari, Emaze Networks S.p.A (roberto.paleari (at) emaze (dot) net [email concealed])

[Vulnerability Information]

Class: Remote NULL pointer dereference


[Affected Software]

We confirm the presence of this vulnerability in the following kernel versions:

- Linux kernel (vanilla)

- Linux kernel (vanilla)

- Linux kernel (vanilla)

- Debian kernel image 2.6.38-2-686

Other Linux kernel versions could be also affected by this issue.

[Vulnerability Details]

In function icmp_send() (net/ipv4/icmp.c), the parameter passed to dev_net()

function is not properly validated. This can lead to a NULL pointer dereference

that crashes the kernel.

An attacker can exploit this bug and cause a DoS, both on a specific target or

on any 2.6.38.x machine connected to the local network. To cause the crash, the

attacker must flood the target with fragmented IPv4 packets. Important fields

in the IP packet are:

* Flags: the MF flag must be set.

* Fragment ID: using pseudo-random values for this field quickly fills

fragmented queues in the victim's kernel, as it is unable to easily

reassemble received packets.

* TOS: using pseudo-random values for this field trigger the creation of more

than one route cache entry for the same destination address, increasing the

chances of incurring in the error condition described before.

Other fields of the packet do not really matter, and they can be set to

arbitrary values.

[Report Timeline]

* 10/05/2011 - Vendor informed

* 10/05/2011 - Vendor asked to publicly disclose the details of this issue


The authors, Emaze Networks S.p.A and Università degli Studi di Milano are not

responsible for the misuse of the information provided in their security

advisories. These advisories are a service to the professional security

community. There are NO WARRANTIES with regard to this information. Any

application or distribution of this information constitutes acceptance AS IS,

at the user's own risk. This information is subject to change without notice.

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus