CVE-2012-6704: linux linux_kernel

Vulnerability summary

CVE-2012-6704 is a high (CVSS 7.8) vulnerability in linux linux_kernel. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 35.6% of scored vulnerabilities.

Timeline

1. 28-12-2016
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUF or (2) SO_RCVBUF option.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.