CVE-2012-2136

La función sock_alloc_send_pskb en net/core/sock.c en el kernel de linux anterior a v3.4.5 no valida correctamente ciertos valores de longitud, permitiendo a usuarios locales causar una denegación de servicio (desbordamiento de búfer basado en el heap o caída del sistema) o ganar privilegios mediante el acceso a un dispositivo TUN/TAP

A flaw was discovered in the Linux kernel's macvtap device driver, which is used in KVM (Kernel-based Virtual Machine) to create a network bridge between host and guest. A privileged user in a guest could exploit this flaw to crash the host, if the vhost_net module is loaded with the experimental_zcopytx option enabled. An error was discovered in the Linux kernel's network TUN/TAP device implementation. A local user with access to the TUN/TAP interface (which is not available to unprivileged users until granted by a root user) could exploit this flaw to crash the system or potential gain administrative privileges. Various other issues were also addressed.