Herbert Xu

O problema está relacionado a um vazamento de memória no componente de criptografia do kernel do Linux, especificamente no módulo qat (Quick Assist Technology). A falha ocorre ao usar `completion done` para determinar se o chamador já encerrou a operação, o que só funciona após a conclusão da chamada. Além disso, existe a possibilidade de que o chamador ainda não tenha chamado `wait for completion`, resultando em outro potencial uso após liberação (UAF). A correção envolve fazer com que o chamador use `cancel work sync` e, em seguida, libere a memória com segurança.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions 2.6.30 and 2.6.30.1 Description: The issue allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of /dev/net/tun. This is due to the tun chr poll function in drivers/net/tun.c in the tun subsystem. Recommendations: For Linux kernel versions 2.6.30 and 2.6.30.1, consider compiling the kernel with the -fno-delete-null-pointer-checks gcc option to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue arises when constructing an ICMP response in the icmp send function, which fails to properly handle the failure of the ip options echo function in icmp.c. This allows remote attackers to cause a denial of service (crash) through specific vectors, including the use of record-route and timestamp IP options with the needaddr bit set and a truncated value.

The issue allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface, specifically through the `ipq read` and `ipulog read` functions.

The Linux kernel does not properly restrict socket policy access to users with the CAP NET ADMIN capability, which could allow local users to conduct unauthorized activities. The vulnerability can be exploited remotely. The issue affects multiple packages in the Debian GNU/Linux operating system, including the kernel, kernel-headers, kernel-image, kernel-pcmcia-modules, lm-sensors, and i2c.