Messages in this thread | | | Date | Thu, 03 May 2007 13:11:39 -0700 (PDT) | Subject | Re: [PATCH 1/5] [NETLINK]: Fix use after free in netlink_recvmsg | From | David Miller <> |
| |
From: Marcel Holtmann <marcel@holtmann.org> Date: Thu, 03 May 2007 14:27:16 +0200
> Hi Dave, > > > > When the user passes in MSG_TRUNC the skb is used after getting freed. > > > > > > Signed-off-by: Patrick McHardy <kaber@trash.net> > > > Signed-off-by: David Howells <dhowells@redhat.com> > > > > Ugh, good catch, applied :-) > > it seems this could be easily exploited and is at least a local DoS. It > should be a candidate for the -stable kernel.
The MSG_TRUNC change is in 2.6.22 GIT only.
You might want to check such things before making such statements. :-/
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |