CVE-2012-2744

[John Johansen]

A NULL pointer dereference flaw was found in the nf_ct_frag6_reasm() function in the Linux kernel's netfilter IPv6 connection tracking implementation. A remote attacker could use this flaw to send specially-crafted packets to a target system that is using IPv6 and also has the nf_conntrack_ipv6 kernel module loaded, causing it to crash.

Break-Fix: - 9e2dcf72023d1447f09c47d77c99b0c49659e5ce

[John Johansen (jjohansen)]

CVE-2012-2744

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 2.6.24-32.104

---------------
linux (2.6.24-32.104) hardy-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1023810

  [Upstream Kernel Changes]

  * netfilter: nf_conntrack_reasm: properly handle packets fragmented into
    a single fragment
    - LP: #1023532
    - CVE-2012-2744
  * KVM: fix backport of 3e51570 on hardy
    - LP: #971685
    - CVE-2012-1601

linux (2.6.24-32.103) hardy-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1020100

  [Upstream Kernel Changes]

  * KVM: MMU: nuke shadowed pgtable pages and ptes on memslot destruction
    - LP: #971685
    - CVE-2012-1601
  * KVM: MMU: do not free active mmu pages in free_mmu_pages()
    - LP: #971685
    - CVE-2012-1601
  * KVM: Don't destroy vcpu in case vcpu_setup fails
    - LP: #971685
    - CVE-2012-1601
  * KVM: Ensure all vcpus are consistent with in-kernel irqchip settings
    - LP: #971685
    - CVE-2012-1601
 -- Luis Henriques <email address hidden> Thu, 12 Jul 2012 10:13:07 +0100