Secunia

Some vulnerabilities have been reported in the Linux Kernel, which can be exploited by malicious, local users to cause a DoS (Denial of Service).

1) Listening IPv6 TCP sockets are incorrectly sharing the "ipv6_fl_socklist" IPv6 flowlist with child sockets. This can be exploited to e.g. cause a kernel crash by performing certain actions on IPv6 TCP sockets.

2) The "hrtimer_forward()" does not correctly check for "timer->expires" overflows on 64bit machines. This can be exploited to cause a DoS by using very large timer values.

Successful exploitation may require a 64bit machine and that high resolution timers are enabled.

3) A NULL pointer dereference within the "do_ipv6_setsockopt()" function in net/ipv6/ipv6_sockglue.c can be exploited to cause a kernel crash by calling "setsockopt()" with malicious parameters.

The vulnerabilities are reported in versions prior to 2.6.20.4.

Solution
Update to version 2.6.20.4.

Provided and/or discovered by
1) Reported by the vendor.
2) Johannes Bauer
3) Gabriel Campana

Changelog
Further details available in Customer Area

Original Advisory
http://marc.info/?l=linux-netdev&m=117406721731891&w=2

http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20.4

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area