Gentoo has fixed a vulnerability in the Linux kernel 2.6 series that could be exploited for a remote denial-of-service attack. The company calls this a "high-impact" flaw and recommends users get the security update outlined in its advisory.
The advisory said the security hole allows an attacker to send a malformed TCP packet. "By sending one malformed packet, the kernel could get stuck in a loop, consuming all of the CPU resources and rendering the machine useless, causing a denial of service," the advisory said. "This vulnerability requires no local access."
Asked if an exploit of the flaw would put data at risk, Gentoo Linux X86 Core and Kernel Team member Tim Yamin said in an e-mail, "No data would be lost as such. But if fresh data is in the kernel's buffers and not yet written to disk[s] it may be lost if the kernel does not come out of the infinite loop."
Asked if the workaround would deprive the user of valuable services, Yamin said, "The workaround only requires any '--tcp-option' rules to be removed. This may be a disadvantage to some who need them, but this would not deny any services unless those rules perform packet forwarding to other destinations, for example. As a result, we urged all our users to upgrade to patched kernels in the GLSA, especially those who rely on '--tcp-option' rules."
Yamin said the flaw was discovered June 30. A customer then reported it to Gentoo, and the company's security team received a notification when the bug was opened. He said everything was patched by July 3.
The Linux kernel manages the core aspects of a GNU/Linux system, providing an interface for core system applications and providing the essential structure and capability to access hardware that is needed for a running system, Gentoo said.
In its advisory, Coppenhagen, Denmark-based IT security firm Secunia called the flaw "moderately critical."