Use-after-free error in Linux kernel - CVE-2017-15115

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU9764

Use-after-free error in Linux kernel - CVE-2017-15115

Published: December 26, 2017


Vulnerability identifier: #VU9764
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-15115
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists due to the sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel does not check whether the intended netns is used in a peel-off action. A local attacker can make specially crafted system calls, trigger use-after-free error and cause the system to crash.

Successful exploitation of the vulnerability results in denial of service.

Affected software

Linux kernel
Amazon Linux AMI
SUSE Linux
Ubuntu
Fedora
kernel

How to mitigate CVE-2017-15115

Update to version 4.14.

kernel - addressed in versions 4.13.13-100.fc25, 4.13.13-200.fc26, 4.13.13-300.fc27

External References

Related Security Bulletins