Multiple race conditions in the terminal layer in Linux 2.4.x, and 2.6.x
before 2.6.9, allow (1) local users to obtain portions of kernel data via a
TIOCSETD ioctl call to a terminal interface that is being accessed by
another thread, or (2) remote attackers to cause a denial of service
(panic) by switching from console to PPP line discipline, then quickly
sending data that is received during the switch.
Updated: 2012-06-01 15:15:54 UTC (commit 5347)