Description
Integer overflow in the ip_options_get function in the Linux kernel before 2.6.10 allows local users to cause a denial of service (kernel crash) via a cmsg_len that contains a -1, which leads to a buffer overflow.
References
- 20041215 fun with linux kernel mailing-list
- 20041215 [USN-47-1] Linux kernel vulnerabilities mailing-list
- http://www.guninski.com/where_do_you_want_billg_to_go_today_2.html
- 11956 vdb-entry
- linux-ipoptionsget-dos(18522) vdb-entry