The ReiserFS support code of Linux 2.6.x fails to properly handle crafted data structures, leading to an exploitable memory corruption condition when a sync is being done in a corrupted ReiserFS filesystem.
- More details
- Proof of concept: MOKB-25-11-2006.img.bz2
