Skip to content
OpenAdvisories
Unscored CVE-2011-1093 EUVD-2011-1107GHSA-rf9x-2w4m-rh77

The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP) implementation in the Linux kern…

Published Jul 18, 2011 · Updated Aug 6, 2024 · Assigned by redhat

Description

The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP) implementation in the Linux kernel before 2.6.38 does not properly handle packets for a CLOSED endpoint, which allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending a DCCP-Close packet followed by a DCCP-Reset packet.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 5.0 linux-2.6 2.6.26-26lenny3 DSA-2264-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 6 perf +13 2.6.32-71.29.1.el6 RHSA-2011:0498
RHEL 5 kernel +11 2.6.18-238.12.1.el5 RHSA-2011:0833
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat MRG 1 perf +10 2.6.33.9-rt31.64.el5rt RHSA-2011:0500

Advisories 4

References