Linux kernel before 2.6.15.3 down to 2.6.12, while constructing an ICMP response in icmp_send, does not properly handle when the ip_options_echo function in icmp.c fails, which allows remote attackers to cause a denial of service (crash) via vectors such as (1) record-route and (2) timestamp IP options with the needaddr bit set and a truncated value.
| Product | Vendor | Version |
|---|---|---|
| n/a | n/a | < f388643657cd5a04dc47a68d85321876c5b4c208 |