Description
The fib6_add_rt2node function in net/ipv6/ip6_fib.c in the IPv6 stack in the Linux kernel through 3.10.1 does not properly handle Router Advertisement (RA) messages in certain circumstances involving three routes that initially qualified for membership in an ECMP route set until a change occurred for one of the first two routes, which allows remote attackers to cause a denial of service (system crash) via a crafted sequence of messages.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 3.10.5-1 | — |
| Debian 13 | linux | 3.10.5-1 | — |
| Debian 12 | linux | 3.10.5-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | dtrace-modules-3.8.13-118.46.1.el6uek | 0.4.5-3.el6 | ELSA-2020-5706 |
| Oracle Linux 7 | dtrace-modules-3.8.13-118.46.1.el7uek | 0.4.5-3.el7 | ELSA-2020-5706 |
| Oracle Linux 7 | kernel-uek +5 | 3.8.13-118.46.1.el7uek | ELSA-2020-5706 |
Advisories 1
- ELSA-2020-5706 Important: Unbreakable Enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 4, 2020
References
- FEDORA-2013-13536 vendor-advisory
- [oss-security] 20130715 Re: CVE Request -- Linux kernel: ipv6: BUG_ON in fib6_add_rt2node() mailing-list
- FEDORA-2013-13663 vendor-advisory
- https://github.com/torvalds/linux/commit/307f2fb95e9b96b3577916e73d92e104f8f26494
- 61166 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=984664
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=307f2fb95e9b96b3577916e73d92e104f8f26494
- 1028780 vdb-entry
- linux-cve20134125-dos(85645) vdb-entry