Secunia

Some vulnerabilities have been reported in the Linux Kernel, which can be exploited by malicious, local users to cause a DoS (Denial of Service).

1) A vulnerability is caused due to "sendmsg()" not correctly blocking while the UNIX garbage collector is running. This can be exploited to e.g. cause soft lockups or trigger out of memory conditions in other applications via certain UNIX socket operations.

2) A vulnerability is caused due to the "svc_listen()" function in net/atm/svc.c allowing users to create unassigned PVC/SVC entries by calling the function multiple times on a socket. This can be exploited to trigger an infinite loop within the "__vcc_walk()" function in net/atm/proc.c by creating unassigned entries and then e.g. reading from /proc/net/atm/vc.

Solution
Vulnerability #1 is fixed in version 2.6.27.8.
Further details available in Customer Area

Provided and/or discovered by
1) Dann Frazier
2) Hugo Dias

Changelog
Further details available in Customer Area

Original Advisory
1) http://article.gmane.org/gmane.linux.network/112695
http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.8

2) http://www.synchlabs.com/advisories/200810-2.htm
http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.9.

Deep Links
Links available in Customer Area