CVE-2017-1000111
Description
Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that changes socket state may race with safety checks in packet_set_ring. Previously with PACKET_VERSION. This time with PACKET_RESERVE. The solution is similar: lock the socket for the update. This issue may be exploitable, we did not investigate further. As this issue affects PF_PACKET sockets, it requires CAP_NET_RAW in the process namespace. But note that with user namespaces enabled, any process can create a namespace in which it has CAP_NET_RAW.
How to fix
- linux linux_kernel3.2.92, 3.10.108, 3.16.47, 3.18.65, 4.1.44, 4.4.82, 4.9.43, 4.12.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 2.6.27 ≤ v < 3.2.92, 3.3 ≤ v < 3.10.108, 3.11 ≤ v < 3.16.47, 3.17 ≤ v < 3.18.65, 3.19 ≤ v < 4.1.44, 4.2 ≤ v < 4.4.82, 4.5 ≤ v < 4.9.43, 4.10 ≤ v < 4.12.7 | 3.2.92, 3.10.108, 3.16.47, 3.18.65, 4.1.44, 4.4.82, 4.9.43, 4.12.7 |
| redhat enterprise_linux | 5.0, 6.0, 7.0 | — |
| redhat enterprise_linux_desktop | 6.0, 7.0 | — |
| redhat enterprise_linux_server | 6.0, 7.0 | — |
| redhat enterprise_linux_server_aus | 7.4, 7.6 | — |
| redhat enterprise_linux_server_eus | 7.4, 7.5, 7.6 | — |
| redhat enterprise_linux_server_tus | 7.4, 7.6 | — |
| redhat enterprise_linux_workstation | 6.0, 7.0 | — |
| debian debian_linux | 8.0, 9.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.