#592184 changing MTU in r8169 driver opens denial-of-service vulnerability

Package:
src:linux
Source:
linux
Submitter:
Ben Hutchings
Date:
2021-05-08 15:12:04 UTC
Severity:
normal
Tags:
#592184#5
Date:
2010-01-07 19:02:24 UTC
From:
To:
Fabian Yamaguchi made a presentation at 26C3
<http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html> which
included a bug in r8169 reintroduced by:

commit fdd7b4c3302c93f6833e338903ea77245eb510b4
Author: Eric Dumazet <eric.dumazet@gmail.com>
Date:   Tue Jun 9 04:01:02 2009 -0700

    r8169: fix crash when large packets are received

On some older r8169 controllers this will enable scattering on receive,
and the first word of the second and subsequent RX buffers for a frame
will wrongly be treated as a status word.  This can be used for denial
of service at the very least.

There is ongoing discussion on netdev about how to fix this.  In the
mean time we should get a CVE number for this.

Ben.
#592184#10
Date:
2010-01-07 19:27:56 UTC
From:
To:
Julien Cristau pointed out the thread
<http://thread.gmane.org/gmane.comp.security.oss.general/2457> where it
appears that Red Hat has allocated CVE-2009-4537 for this.

Ben.
#592184#19
Date:
2010-01-08 03:11:35 UTC
From:
To:
do you follow kernel-sec [0]?  i entered these CVEs when they were
first disclosed over a week ago.

mike

[0] http://svn.debian.org/wsvn/kernel-sec
#592184#24
Date:
2010-01-13 19:08:19 UTC
From:
To:
# Automatically generated email from bts, devscripts version 2.10.35lenny7
# Also applies to these versions and should not block testing migration
found 564110 2.6.30-8
found 564110 2.6.30-8squeeze1
#592184#33
Date:
2010-03-17 17:01:43 UTC
From:
To:
issue got fixed in 2.6.32.9.
is stable affected?

Ben wanted to review it before stable upload as rh/fedora fix went
throug several iterations. although they seem to have settled now.
#592184#38
Date:
2010-03-17 17:34:49 UTC
From:
To:
It's not properly fixed - if you ever change MTU the vulnerability will
be reopened.  And the fix introduces a severe performance regression even
for hardware that doesn't have the issue.

Unfortunately there seems to be no intersection between the groups of
people with affected hardware and people who have a clue how to write
drivers.

Ben.
#592184#43
Date:
2010-08-01 21:53:31 UTC
From:
To:
can we downgrade the severity of this issue since there is a fix
included (even though it isn't ideal)?  it's currently RC.

best wishes,
mike
#592184#48
Date:
2010-08-01 23:44:50 UTC
From:
To:
Let's clone it, close this one and downgrade the clone.  That way we
will have proper version-tracking of the original big hole and the
remaining smaller hole.

Ben.