The mISDN_sock_recvmsg function in drivers/isdn/mISDN/socket.c in the Linux kernel before 3.12.4 does not ensure that a certain length value is consistent with the size of an associated data structure, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
| Product | Vendor | Version |
|---|---|---|
| n/a | n/a | 8.0.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0 |