Control: retitle -1 fastd: CVE-2020-27638: DoS'able memory leak on invalid packets
On Mon, Oct 19, 2020 at 10:21:16PM +0200, Sven Eckelmann wrote: > Package: fastd > Severity: important > Version: 17-4 > > fastd doesn't free receive buffers for invalid packets. This can lead to > memory exhaustion or (with v20) to an assert. From the release text: > > The new buffer management of fastd v20 revealed that received packets > with an > invalid type code were handled incorrectly, leaking the packet buffer. > This lead > to an assertion failure as soon as the buffer pool was empty, crashing > fastd. > > Older versions of fastd are affected as well, but display a different > behaviour: > instead of crashing, the buffer leaks will manifest as a regular memory > leak. > This can still be used for Denial of Service attacks, so a patch for older > versions will be provided, for the case that users can't or do not want to > update to a newer version yet. > > The fix can also be found inside the attached mail. CVE-2020-27638 was assigned for this issue. Regards, Salvatore
