Race condition in Linux kernel - CVE-2017-15951

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU9604

Race condition in Linux kernel - CVE-2017-15951

Published: December 8, 2017


Vulnerability identifier: #VU9604
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-15951
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists due to the KEYS subsystem does not correctly synchronize the actions of updating versus finding a key in the "negative" state. A local attacker can make a specially crafted system calls, trigger race condition and cause the service to crash.

Successful exploitation of the vulnerability results in denial of service.

Affected software

Linux kernel
Amazon Linux AMI
SUSE Linux
Ubuntu
Fedora
kernel

How to mitigate CVE-2017-15951

Update to version 4.13.10.

kernel - addressed in versions 4.13.10-100.fc25, 4.13.10-200.fc26, 4.13.10-300.fc27

External References

Related Security Bulletins