Re: [PATCH 1/5] [NETLINK]: Fix use after free in netlink_recvmsg
flat view
From: David Miller <davem@davemloft.net>
Date: 2007-05-03 20:11:38
Also in:
linux-fsdevel, lkml
From: Marcel Holtmann <marcel@holtmann.org> Date: Thu, 03 May 2007 14:27:16 +0200
Hi Dave,quoted
quoted
When the user passes in MSG_TRUNC the skb is used after getting freed. Signed-off-by: Patrick McHardy <redacted> Signed-off-by: David Howells <dhowells@redhat.com>Ugh, good catch, applied :-)it seems this could be easily exploited and is at least a local DoS. It should be a candidate for the -stable kernel.
The MSG_TRUNC change is in 2.6.22 GIT only. You might want to check such things before making such statements. :-/