VULHUB ™

Bugtraq ID: 47853 CVE ID：CVE-2011-1768 Linux是一款开放源代码的操作系统。 net/ipv6/ip6_tunnel.c文件中IPv6隧道初始化函数包含如下代码： /** 02 * ip6_tunnel_init - register protocol and reserve needed resources 03 * 04 * Return: 0 on success 05 **/ 06 07 static int __init ip6_tunnel_init(void) 08 { 09 int err; 10 11 if (xfrm6_tunnel_register(&ip4ip6_handler, AF_INET)) { 12 printk(KERN_ERR "ip6_tunnel init: can't register ip4ip6\n"); 13 err = -EAGAIN; 14 goto out; 15 } 16 17 if (xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6)) { 18 printk(KERN_ERR "ip6_tunnel init: can't register ip6ip6\n"); 19 err = -EAGAIN; 20 goto unreg_ip4ip6; 21 } 22 23 err = register_pernet_gen_device(&ip6_tnl_net_id, &ip6_tnl_net_ops); 24 if (err < 0) 25 goto err_pernet; 26 return 0; 27 err_pernet: 28 xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6); 29 unreg_ip4ip6: 30 xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET); 31 out: 32 return err; 33 }...

Bugtraq ID: 47853 CVE ID：CVE-2011-1768 Linux是一款开放源代码的操作系统。 net/ipv6/ip6_tunnel.c文件中IPv6隧道初始化函数包含如下代码： /** 02 * ip6_tunnel_init - register protocol and reserve needed resources 03 * 04 * Return: 0 on success 05 **/ 06 07 static int __init ip6_tunnel_init(void) 08 { 09 int err; 10 11 if (xfrm6_tunnel_register(&ip4ip6_handler, AF_INET)) { 12 printk(KERN_ERR "ip6_tunnel init: can't register ip4ip6\n"); 13 err = -EAGAIN; 14 goto out; 15 } 16 17 if (xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6)) { 18 printk(KERN_ERR "ip6_tunnel init: can't register ip6ip6\n"); 19 err = -EAGAIN; 20 goto unreg_ip4ip6; 21 } 22 23 err = register_pernet_gen_device(&ip6_tnl_net_id, &ip6_tnl_net_ops); 24 if (err < 0) 25 goto err_pernet; 26 return 0; 27 err_pernet: 28 xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6); 29 unreg_ip4ip6: 30 xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET); 31 out: 32 return err; 33 } 可以看到，函数会首先注册‘ip4ip6_handler’协议处理器函数，然后处理注册‘ip6_tnl_net_ops’回调函数，如果用户调用位于上述结构中的某个函数指针，会由于未初始化指针尝试访问非法内存而触发访问冲突。 Linux kernel 2.6.x 厂商解决方案 用户可参考如下供应商提供的安全补丁： http://xorl.wordpress.com/2011/05/14/cve-2011-1768-linux-kernel-tunnels-remote-race-condition/