Description of problem: Both PPPoL2TP (in net/l2tp/l2tp_ppp.c, pppol2tp_sendmsg()) and IPoL2TP (in net/l2tp/l2tp_ip.c, l2tp_ip_sendmsg()) make calls to sock_wmalloc() that perform arithmetic on the size argument without any maximum bound. As a result, by issuing sendto() calls with very large sizes, this allocation size will wrap and result in a small buffer being allocated, leading to ugliness immediately after (probably kernel panics due to bad sk_buff tail position, but possibly kernel heap corruption). Reference: http://www.spinics.net/lists/netdev/msg145673.html Acknowledgements: Red Hat would like to thank Dan Rosenberg for reporting this issue.
Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 3, 4 and 5 did not include L2TP functionality, and therefore are not affected by this issue. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0007.html and https://rhn.redhat.com/errata/RHSA-2011-0330.html.
This issue has been assigned the name CVE-2010-4160.
http://git.kernel.org/linus/253eacc070b114c2ec1f81b067d2fed7305467b0 http://git.kernel.org/linus/8acfe468b0384e834a303f08ebc4953d72fb690a
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2011:0007 https://rhn.redhat.com/errata/RHSA-2011-0007.html
This issue has been addressed in following products: MRG for RHEL-5 Via RHSA-2011:0330 https://rhn.redhat.com/errata/RHSA-2011-0330.html