[oss-security] CVE-2018-10938: Linux kernel: net: infinite loop in net/ipv4/cipso_ipv4.c:cipso_v4_optptr() allows a remote DoS

[Vladis Dronov]

Heololo,

A flaw was found in the Linux kernel present since v4.0-rc1 and through v4.13-rc4.
A crafted network packet sent remotely by an attacker may force the kernel to enter
an infinite loop in the cipso_v4_optptr() function in net/ipv4/cipso_ipv4.c leading
to a denial-of-service.

All the kernels with the cipso_v4_optptr() function which have not backported
the upstream commit 40413955ee26 are vulnerable.

Thanks to Yves Younan from Cisco for mentioning this.

References:

https://bugzilla.redhat.com/show_bug.cgi?id=1622404

Upstream Patch introduced the flaw:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04f81f0154e4bf002be6f4d85668ce1257efa4d9

Upstream Patch fixed the flaw:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=40413955ee265a5e42f710940ec78f5450d49149

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer

[Greg KH]

Post by Vladis Dronov
Heololo,
A flaw was found in the Linux kernel present since v4.0-rc1 and through v4.13-rc4.
A crafted network packet sent remotely by an attacker may force the kernel to enter
an infinite loop in the cipso_v4_optptr() function in net/ipv4/cipso_ipv4.c leading
to a denial-of-service.
All the kernels with the cipso_v4_optptr() function which have not backported
the upstream commit 40413955ee26 are vulnerable.
Thanks to Yves Younan from Cisco for mentioning this.
https://bugzilla.redhat.com/show_bug.cgi?id=1622404
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04f81f0154e4bf002be6f4d85668ce1257efa4d9
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=40413955ee265a5e42f710940ec78f5450d49149

To be more specific here (as I complained about the other CVE report for
the kernel a minute ago), this means currently the 3.18.y, 4.4.y, and
4.9.y kernels are vulnerable to this problem. I'll go backport the
patch above now to those trees and it will be included in the next
releases of these kernel trees later this week.

Thanks for posting this here, it is helpful, and I appreciate it.

greg k-h