Description
The tcp_find_option function of the netfilter subsystem in Linux kernel 2.6, when using iptables and TCP options rules, allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a large option length that produces a negative integer after a casting operation to the char type.
References
- FEDORA-2004-202 vendor-advisory
- GLSA-200407-12 vendor-advisory
- 20040630 Remote DoS vulnerability in Linux kernel 2.6.x mailing-list
- linux-tcpfindoption-dos(16554) vdb-entry
- CLA-2004:852 vendor-advisory
- SUSE-SA:2004:020 vendor-advisory