CVE-2010-1188

kernel: ipv6: skb is unexpectedly freed

Published Mar 31, 2010 CVSS 2.0 · 7.1 High EPSS 3.3% KEV · Not listed
Description
Use-after-free vulnerability in net/ipv4/tcp_input.c in the Linux kernel 2.6 before 2.6.20, when IPV6_RECVPKTINFO is set on a listening socket, allows remote attackers to cause a denial of service (kernel panic) via a SYN packet while the socket is in a listening (TCP_LISTEN) state, which is not properly handled and causes the skb structure to be freed.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2010-1218 Use-after-free vulnerability in net/ipv4/tcp_input.c in the Linux kernel 2.6 before 2.6.20, when IPV6_RECVPKTINFO is set on a listening socket, allows remote attackers to cause a denial of service (kernel panic) via a SYN packet while the socket is in a listening (TCP_LISTEN) state, which is not properly handled and causes the skb structure to be freed.
Ubuntu USN Ubuntu USN USN-947-1 Linux kernel vulnerabilities
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 7, 2024, 1:14 AM
Reserved
Mar 30, 2010, 12:00 AM
Status
Modified
Published
Mar 31, 2010, 6:00 PM
Modified
Jun 16, 2026, 11:17 PM
Severity
Important
Public date
Jan 23, 2007, 12:00 AM