[kernel-sec-discuss] r751 - active

[Martin Pitt]

Author: mpitt
Date: 2007-04-25 13:34:15 +0000 (Wed, 25 Apr 2007)
New Revision: 751

Modified:
   active/CVE-2007-1592
Log:
CVE-2007-1592: details, git url, Ubuntu status

Modified: active/CVE-2007-1592
===================================================================
--- active/CVE-2007-1592	2007-04-25 12:30:24 UTC (rev 750)
+++ active/CVE-2007-1592	2007-04-25 13:34:15 UTC (rev 751)
@@ -1,7 +1,16 @@
 Candidate: CVE-2007-1592
 References: 
+ http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d35690beda1429544d46c8eb34b2e3a8c37ab299
 Description: 
+ net/ipv6/tcp_ipv6.c in Linux kernel 2.6.x up to 2.6.21-rc3
+ inadvertently copies the ipv6_fl_socklist from a listening TCP socket
+ to child sockets, which allows local users to cause a denial of
+ service (OOPS) or double-free by opening a listening IPv6 socket,
+ attaching a flow label, and connecting to that socket.
 Ubuntu-Description: 
+ Masayuki Nakagawa discovered an error in the flowlabel handling of
+ IPv6 network sockets. A local attacker could exploit this to crash
+ the kernel.
 Notes: 
 Bugs: 
 upstream: released (2.6.20.4, 2.6.21-rc5)
@@ -9,6 +18,6 @@
 2.6.18-etch-security: pending (2.6.18.dfsg.1-12etch1) [bugfix/ipv6_fl_socklist-no-share.patch]
 2.6.8-sarge-security: pending (2.6.8-16sarge7) [ipv6_fl_socklist-no-share.dpatch]
 2.4.27-sarge-security: pending (2.4.27-10sarge6) [243_ipv6_fl_socklist-no-share.diff]
-2.6.12-breezy-security: 
-2.6.15-dapper-security: 
-2.6.17-edgy-security: 
+2.6.15-dapper-security: needed
+2.6.17-edgy-security: needed
+2.6.20-edgy-security: needed