Multiple vulnerabilities in Linux kernel

1) Out-of-bounds write

EUVDB-ID: #VU30815

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-18552

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local authenticated user to execute arbitrary code.

An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rds_recv_track_latency.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 4.0 - 4.10.17

External links

http://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=780e982905bef61d13496d9af5310bf4af3a64d3
http://support.f5.com/csp/article/K02460950
http://support.f5.com/csp/article/K02460950?utm_source=f5support&utm_medium=RSS

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU30823

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-18509

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local authenticated user to execute arbitrary code.

An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels before 4.9.187.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 4.0 - 4.10.17

External links

http://packetstormsecurity.com/files/154059/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=99253eb750fda6a644d5188fb26c43bad8d5a745
http://github.com/torvalds/linux/commit/99253eb750fda6a644d5188fb26c43bad8d5a745
http://lists.debian.org/debian-lts-announce/2019/08/msg00016.html
http://lists.debian.org/debian-lts-announce/2019/08/msg00017.html
http://lists.openwall.net/netdev/2017/12/04/40
http://pulsesecurity.co.nz/advisories/linux-kernel-4.9-inetcsklistenstop-gpf
http://salsa.debian.org/kernel-team/linux/commit/baefcdc2f29923e7325ce4e1a72c3ff0a9800f32
http://seclists.org/bugtraq/2019/Aug/26
http://support.f5.com/csp/article/K41582535
http://support.f5.com/csp/article/K41582535?utm_source=f5support&utm_medium=RSS
http://usn.ubuntu.com/4145-1/
http://www.debian.org/security/2019/dsa-4497

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.