Description: Three vulnerabilities have been identified in the Linux Kernel 2.4 branch. One can be exploited to cause a Denial of Service by a malicious person and is very similar to the recent Linux Kernel Denial of Service. The others are local Denial of Service vulnerabilities.
The remote Denial of Service is possible, because malicious people can cause hash table collisions by sending a stream of maliciously crafted fragmented TCP packets. This will cause the system to consume large amounts of CPU resources.
It is possible to cause a kernel oops, because of an unspecified vulnerability in the tty layer. This could possibly reveal sensitive information to local users or cause a Denial of Service.
A malformed address may cause low level mxcsr code to leave garbage in CPU state registers. This could possibly lead to a Denial of Service.
Solution: We are not aware of any official patches for the Linux Kernel.
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
