Denial of Service and Code Execution Vulnerabilities in Linux Kernel IGMP Functionality

CVE-2004-1137

Summary

The Linux kernel versions ranging from 2.4.22 to 2.4.28 and 2.6.0 to 2.6.9 exhibit multiple vulnerabilities in IGMP functionality. These flaws can be exploited by local and remote attackers through specific functions. The ip_mc_source function allows an attacker to decrement a critical counter to -1, potentially leading to a denial of service. Meanwhile, the igmp_marksources function fails to validate IGMP message parameters adequately, leading to out-of-bounds read conditions that can facilitate arbitrary code execution.

References