Out-of-bounds read in Linux kernel - CVE-2017-7558

 

Out-of-bounds read in Linux kernel - CVE-2017-7558

Published: August 24, 2017 / Updated: June 17, 2021


Vulnerability identifier: #VU8008
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-7558
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a local attacker to obtain potentially sensitive information.

The weakness exists due to put-of-bounds read in the inet_diag_msg_sctpaddrs_fill(), inet_diag_msg_sctpladdrs_fill(), and sctp_get_sctp_info() functions in 'net/sctp/sctp_diag.c'. A local attacker can gain access to important data in portions of slab memory on the target system.

Affected software

Linux kernel
Debian Linux
Amazon Linux AMI
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server (for IBM Power LE) - 4 Year Extended Update Support
Red Hat Enterprise Linux Server - 4 Year Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - Extended Update Support
Fedora

MRG Realtime
kernel (Red Hat package)
kernel-rt (Red Hat package)
kernel
Red Hat Virtualization Host

How to mitigate CVE-2017-7558

Update to the latest version.

kernel (Red Hat package) - update to 3.10.0-693.5.2.el7
kernel-rt (Red Hat package) - addressed in versions 3.10.0-693.5.2.rt56.592.el6rt, 3.10.0-693.5.2.rt56.626.el7
kernel - addressed in versions 4.12.9-200.fc25, 4.12.9-300.fc26

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins