Problem Description:
When the PCM sample array needs to grow, the RACK stack doubles
a 16-bit allocation counter. Repeated doublings caused the counter
to wrap to zero, resulting in a near-zero-length allocation followed
by a copy of the existing samples into the undersized buffer. A
remote peer can trigger the expansion by sending a sufficient number
of ACKs on an established connection.
Impact:
A remote attacker who can establish a TCP connection to a system
using the RACK stack can trigger an out-of-bounds write of approximately
512 KB in the kernel heap possibly resulting in a kernel panic.