CVE-2010-4165
Linux Kernel < 2.6.37 - Denial of Service via TCP_MAXSEG Setsockopt
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2010-4165. PoCs published by prdelka, zx2c4.
AI-analyzed exploit summary This exploit triggers a divide-by-zero error in the Linux Kernel's tcp_select_initial_window function by setting TCP_MAXSEG to a malformed value via setsockopt(), causing a local denial-of-service (kernel oops). It requires a listening socket and a subsequent TCP connection to trigger the vulnerability.
Description
The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel before 2.6.37-rc2 does not properly restrict TCP_MAXSEG (aka MSS) values, which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value, leading to a divide-by-zero error or incorrect use of a signed integer.
Exploits (2)
This exploit triggers a divide-by-zero error in the Linux Kernel's tcp_select_initial_window function by setting TCP_MAXSEG to a malformed value via setsockopt(), causing a local denial-of-service (kernel oops). It requires a listening socket and a subsequent TCP connection to trigger the vulnerability.
This exploit triggers a divide-by-zero error in the Linux kernel (CVE-2010-4165) by setting an invalid TCP_MAXSEG value, causing a kernel panic and system crash. It demonstrates a reliable DoS condition affecting Linux kernels prior to 2.6.37-rc2.