PT-2026-47608

netty unix socket recvFd sets msg control to char controlCMSG SPACEsizeofint line 940 — 24 bytes on 64-bit Linux. A peer-sent SCM RIGHTS cmsg carrying two ints has cmsg len = CMSG LEN8 = 24, which fits exactly with no MSG CTRUNC, so the kernel installs both fds in the receiving process. The...

CVE-2004-1334

Integer overflow in the ipoptionsget function in the Linux kernel before 2.6.10 allows local users to cause a denial of service kernel crash via a cmsglen that contains a -1, which leads to a buffer overflow...

PT-2004-2256 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.10 Description: The issue is related to an integer overflow in the ip options get function, which can be exploited by local users to cause a denial of service, resulting in a kernel crash. This is achieved b...