Vasiliy Averin has reported a vulnerability in the Linux kernel, which potentially can be exploited by malicious, local users to cause a DoS (Denial of Service).

The vulnerability is caused due to the missing use of "sockfd_put()" in "routing_ioctl()" on 64-bit platforms. This may be exploited to overrun a reference counter via a large number of fget() requests. Subsequent call to fput() will cause resources to be incorrectly freed, which can potentially crash the kernel. Similar vulnerability exists in "tiocgdev()" on x86-64 platforms.

The vulnerability only affects 64-bit platforms.

Solution
The vulnerability has been fixed in version 2.6.13.2.

Provided and/or discovered by
Vasiliy Averin

Changelog
Further details available to Secunia VIM customers

Original Advisory
Kernel.org:
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.13.2

Deep Links
Links available to Secunia VIM customers