PT-2012-2399 · Linux+2 · Linux Kernel+2

Simon Mcvittie · Published 2012-01-13 · Updated 2023-01-17 · CVE-2012-0207

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.2.1

Description The issue allows remote attackers to cause a denial of service, resulting in a divide-by-zero error and a kernel panic, through IGMP packets. This is due to the igmp heard query function in net/ipv4/igmp.c.

Recommendations For Linux kernel versions prior to 3.2.1, update to version 3.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to IGMP packets to minimize the risk of exploitation.

Exploit

Fix

DoS

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

CESA-2012_0350

CVE-2012-0207

RHSA-2012:0107

RHSA-2012:0333

RHSA-2012:0350

RHSA-2012:0422

RHSA-2012_0107

RHSA-2012_0350

USN-1356-1

USN-1363-1

USN-1364-1

USN-1380-1

USN-1384-1

USN-1386-1

Affected Products

Centos

Linux Kernel

Red Hat

References · 21

• 🔥 https://exploit-db.com/exploits/18378 · Exploit
• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=654876 · Exploit
• https://github.com/torvalds/linux/commit/25c413ad0029ea86008234be28aee33456e53e5b · Patch
• https://github.com/torvalds/linux/commit/a8c1f65c79cbbb2f7da782d4c9d15639a9b94b27 · Patch
• https://ubuntu.com/security/CVE-2012-0207 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-0207 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1386-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1364-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=772867 · Patch
• http://kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1380-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2012-0350.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1384-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1363-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1356-1 · Vendor Advisory