Description
drivers/net/r8169.c in the r8169 driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to (1) cause a denial of service (temporary network outage) via a packet with a crafted size, in conjunction with certain packets containing A characters and certain packets containing E characters; or (2) cause a denial of service (system crash) via a packet with a crafted size, in conjunction with certain packets containing '\0' characters, related to the value of the status register and erroneous behavior associated with the RxMaxSize register. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1389.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | linux-2.6 | 2.6.26-22lenny1 | DSA-2053-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +11 | 2.6.18-164.10.1.el5 | RHSA-2010:0019 |
| RHEL 5 | rhev-hypervisor +1 | 5.4-2.1.8.el5_4rhev2_1 | RHSA-2010:0095 |
| RHEL 4 | kernel +10 | 2.6.9-89.0.19.EL | RHSA-2010:0020 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5.3 EUS | kernel +11 | 2.6.18-128.12.1.el5 | RHSA-2010:0053 |
| RHEL 5.2 EUS | kernel +11 | 2.6.18-92.1.35.el5 | RHSA-2010:0079 |
| RHEL 4.7 EUS | kernel +10 | 2.6.9-78.0.29.EL | RHSA-2010:0111 |
| Red Hat MRG 1 | kernel-rt +9 | 2.6.24.7-146.el5rt | RHSA-2010:0041 |
Advisories 8
- RHSA-2010:0111 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0095 Red Hat Security Advisory: rhev-hypervisor security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0079 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0053 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0041 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0020 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0019 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-2053-1 linux-2.6 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=550907
- 37521 vdb-entry
- SUSE-SA:2010:031 vendor-advisory
- oval:org.mitre.oval:def:9439 vdb-entry signature
- RHSA-2010:0111 vendor-advisory
- http://blog.c22.cc/2009/12/27/26c3-cat-procsysnetipv4fuckups/
- 1023419 vdb-entry
- RHSA-2010:0053 vendor-advisory
- [linux-netdev] 20091228 [PATCH RFC] r8169: straighten out overlength frame detection mailing-list
- RHSA-2010:0019 vendor-advisory
- 40645 third-party-advisory
- kernel-r8169-dos(55647) vdb-entry
- [oss-security] 20091228 CVE requests - kernel security regressions for CVE-2009-1385/and -1389 mailing-list
- FEDORA-2010-1787 vendor-advisory
- [oss-security] 20091229 Re: CVE requests - kernel security regressions for CVE-2009-1385/and -1389 mailing-list
- SUSE-SA:2010:023 vendor-advisory
- http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html
- RHSA-2010:0095 vendor-advisory
- 39742 third-party-advisory
- [oss-security] 20091231 Re: CVE requests - kernel security regressions for CVE-2009-1385/and -1389 mailing-list
- RHSA-2010:0020 vendor-advisory
- 38031 third-party-advisory
- oval:org.mitre.oval:def:7443 vdb-entry signature
- 38610 third-party-advisory
- DSA-2053 vendor-advisory
- http://twitter.com/dakami/statuses/7104238406
- http://marc.info/?t=126202986900002&r=1&w=2
- 39830 third-party-advisory
- RHSA-2010:0041 vendor-advisory
- ADV-2010-1857 vdb-entry