CVE-2013-2224

Published: 4 July 2013

A certain Red Hat patch for the Linux kernel 2.6.32 on Red Hat Enterprise Linux (RHEL) 6 allows local users to cause a denial of service (invalid free operation and system crash) or possibly gain privileges via a sendmsg system call with the IP_RETOPTS option, as demonstrated by hemlock.c. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-3552.

Notes

Unprivileged user kernel crash demonstrated; code execution
neither confirmed nor denied.

This is a Red Hat specific bug introduced by their CVE-2012-3552
fix.  This was a backport of upstream
f6d8bd051c391c1c0458a30b2a7abcd939329259.  Only Lucid contains a
backport of this commit (all the other Ubuntu kernels include the
upstream commit) and Lucid backport is quite different from RH
one (it was picked from upstream 3.2, which picked it from
Debian).

Status

References

• https://www.rack911.com/poc/hemlock.c
• http://www.openwall.com/lists/oss-security/2013/06/30/6
• http://www.openwall.com/lists/oss-security/2013/07/02/4
• https://www.cve.org/CVERecord?id=CVE-2013-2224
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1196796
• https://bugzilla.redhat.com/show_bug.cgi?id=979936