Vulnerability identifier: #VU30823

Vulnerability risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-18509

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local authenticated user to execute arbitrary code.

An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels before 4.9.187.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: 4.0 - 4.0.9, 4.1 - 4.1.52, 4.2 - 4.2.8, 4.3 - 4.3.6, 4.4 - 4.4.224, 4.5 - 4.5.7, 4.6 - 4.6.7, 4.7 - 4.7.10, 4.8 - 4.8.17, 4.9 - 4.9.224, 4.10 - 4.10.17

---

External links
http://packetstormsecurity.com/files/154059/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=99253eb750fda6a644d5188fb26c43bad8d5a745
http://github.com/torvalds/linux/commit/99253eb750fda6a644d5188fb26c43bad8d5a745
http://lists.debian.org/debian-lts-announce/2019/08/msg00016.html
http://lists.debian.org/debian-lts-announce/2019/08/msg00017.html
http://lists.openwall.net/netdev/2017/12/04/40
http://pulsesecurity.co.nz/advisories/linux-kernel-4.9-inetcsklistenstop-gpf
http://salsa.debian.org/kernel-team/linux/commit/baefcdc2f29923e7325ce4e1a72c3ff0a9800f32
http://seclists.org/bugtraq/2019/Aug/26
http://support.f5.com/csp/article/K41582535
http://support.f5.com/csp/article/K41582535?utm_source=f5support&utm_medium=RSS
http://usn.ubuntu.com/4145-1/
http://www.debian.org/security/2019/dsa-4497

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.