Secunia

Two vulnerabilities and a weakness have been reported in the Linux Kernel, which can be exploited by malicious, local users to cause a DoS (Denial of Service) and disclose potentially sensitive information, and by malicious people to cause a DoS.

1) An input validation error in SCTP when processing a HB-ACK chunk with a specially-crafted parameter length can be exploited to cause out-of-bounds memory access. This can potentially cause the system to crash.

2) An error in SCTP chunk length calculation during parameter processing can be exploited to cause out-of-bounds memory access. This can potentially cause the system to crash.

3) A race condition in the "do_add_counters()" function in netfilter can be exploited by local users to read kernel memory or cause the system to crash via a race condition that produces a size value that is different from the size of the allocated memory.

Successful exploitation requires that the user is granted CAP_NET_ADMIN rights.

Solution
Update to version 2.6.16.17.
Further details available in Customer Area

Provided and/or discovered by
1-2) Reported by vendor.
3) Solar Designer

Changelog
Further details available in Customer Area

Original Advisory
Kernel.org:
http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.17

Deep Links
Links available in Customer Area