CVE-2013-4470

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.12

Description The issue allows local users to cause a denial of service, resulting in memory corruption and system crash, or possibly gain privileges. This is achieved through a crafted application that uses the UDP CORK option in a setsockopt system call and sends both short and long packets. The problem is related to the ip ufo append data function in net/ipv4/ip output.c and the ip6 ufo append data function in net/ipv6/ip6 output.c.

Recommendations For Linux kernel versions prior to 3.12, update to version 3.12 or later to resolve the issue. As a temporary workaround, consider disabling UDP Fragmentation Offload (UFO) until a patch is available.