The Linux kernel contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when custom crafted ICMP fragments are sent to the kernel, which will trigger an ICMP TTL exceeded error packet containing data from memory in response. This will disclose information in memory, resulting in a loss of confidentiality.
Classification
Location:
Local Access Required,
Remote / Network Access
Attack Type:
Information Disclosure,
Input Manipulation
Impact:
Loss of Confidentiality
Exploit:
Exploit Public
Solution
Upgrade to a kernel version of 2.2.19, 2.4.0 mainline, or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by applying the vendor-supplied patch.
tasmail.com -
