The bcm_release function in net/can/bcm.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release operation.
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Linux_kernel | Linux | * | 2.6.39 (excluding) |
Linux_kernel | Linux | 2.6.39 (including) | 2.6.39 (including) |
Linux_kernel | Linux | 2.6.39-rc1 (including) | 2.6.39-rc1 (including) |
Linux_kernel | Linux | 2.6.39-rc2 (including) | 2.6.39-rc2 (including) |
Linux_kernel | Linux | 2.6.39-rc3 (including) | 2.6.39-rc3 (including) |
Linux_kernel | Linux | 2.6.39-rc4 (including) | 2.6.39-rc4 (including) |
Linux_kernel | Linux | 2.6.39-rc5 (including) | 2.6.39-rc5 (including) |