Summary: A signed integer overflow in __pmGetPDU() (pdu.c:661) permanently corrupts
the process-wide static variable maxsize, rendering the affected daemon unable to read any
PDU for the remainder of its lifetime. No authentication or prior session state is required.
When php->len = 0x7FFFFFFF, the expression PDU_CHUNK * (1 + php->len / PDU_CHUNK)
overflows to -2147483648. Every subsequent call to __pmFindPDUBuf(maxsize) returns
NULL, causing silent connection failures. Two attack vectors were confirmed: pmlogger TCP
4330 (conditional on PMLOGGER_LOCAL being unset) and pmcd TCP 44321 during SASL
negotiation.
Prerequisites: Vector 1 (pmlogger TCP 4330): Default installation, no credentials required.
Bound to loopback by default; remotely exploitable only if PMLOGGER_LOCAL is unset.
Vector 2 (pmcd TCP 44321): SASL configured (standard in major distro packages). Bound to
loopback by default; remotely exploitable only if the operator altered the binding
configuration.