Assertion failure in Linux kernel - CVE-2017-5986

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU5868

Assertion failure in Linux kernel - CVE-2017-5986

Published: February 18, 2017 / Updated: February 19, 2017


Vulnerability identifier: #VU5868
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-5986
CWE-ID: CWE-617
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to cause kernel panic.

The vulnerability exists due to a race condition in the sctp_wait_for_sndbuf() function in net/sctp/socket.c in the Linux kernel before 4.9.11. A local user can use userspace application to trigger a BUG_ON() system call if the socket tx buffer is full and cause kernel panic.

Successful exploitation of this vulnerability may result in denial of service condition.



Affected software

Linux kernel
CentOS
SUSE Linux
Ubuntu
Fedora
kernel (Red Hat package)
kernel

How to mitigate CVE-2017-5986

Update to version 4.9.11.

kernel (Red Hat package) - update to 3.10.0-514.21.1.el7
kernel - addressed in versions 4.9.9-100.fc24, 4.9.9-200.fc25

External References

Related Security Bulletins