NULL pointer dereference in Linux kernel - CVE-2017-11176

Vulnerability identifier: #VU16551

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-11176

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to cause DoS condition.

The vulnerability exists due to the mq_notify function does not set the sock pointer to NULL upon entry into the retry logic. A remote attacker can trigger use-after-free error during a user-space close of a Netlink socket and cause the service to crash.

Linux kernel
Red Hat Enterprise Linux Server - Extended Life Cycle Support
Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems)
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server (for IBM Power LE) - 4 Year Extended Update Support
Red Hat Enterprise Linux Server - 4 Year Extended Update Support
Fedora

MRG Realtime
kernel (Red Hat package)
kernel-rt (Red Hat package)
kernel
Red Hat Virtualization Host

Install update from vendor's website.

kernel (Red Hat package) - addressed in versions 2.6.32-696.20.1.el6, 3.10.0-693.5.2.el7
kernel-rt (Red Hat package) - addressed in versions 3.10.0-693.5.2.rt56.592.el6rt, 3.10.0-693.5.2.rt56.626.el7
kernel - addressed in versions 4.11.11-100.fc24, 4.11.11-200.fc25, 4.11.11-300.fc26, 4.11.12-100.fc24

• Exploit #6118 - Linux Kernel < 4.11.8 - 'mq_notify: double sock_put()' Local Privilege Escalation (June 17, 2021)
• Exploit #5165 - kernel-exploit-factory (Linux kernel CVE exploit analysis report and relative debug environment. You don't need to compile Linux kernel and configure your environment anymore. ) (February 23, 2021)
• Exploit #3498 - CVE-2017-5123 (PoC CVE-2017-5123 - LPE - Bypassing SMEP/SMAP. No KASLR) (July 15, 2020)
• Exploit #2260 - exploits (exploits™) (April 3, 2020)
• Exploit #228 - cve-2017-11176 (My first try to code my own LPE exploit.) (March 18, 2020)

• https://github.com/torvalds/linux/commit/f991af3daabaecff34684fd51fac80319d1baad1

• Red Hat update for kernel
• Red Hat update for kernel
• Red Hat update for kernel-rt
• Red Hat update for kernel
• Fedora 26 update for kernel
• Fedora 25 update for kernel
• Fedora 24 update for kernel
• Fedora 24 update for kernel
• Red Hat Enterprise MRG 2 update for kernel-rt