CVE-2017-15129 A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::c...
MediumCVSS 4.7
EPSS 0.36%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 4.14.12-1 | 4.14.12-1 |
| debian/linux(Debian:13) | < 4.14.12-1 | 4.14.12-1 |
| debian/linux(Debian:14) | < 4.14.12-1 | 4.14.12-1 |
| Linux kernel | >= 4.0, < 4.14.11 | 4.14.11 |
| Linux kernel | = 4.15-rc1 | No fix listed |
| Linux kernel | = 4.15-rc2 | No fix listed |
| Linux kernel | = 4.15-rc3 | No fix listed |
| Linux kernel | = 4.15-rc4 | No fix listed |
| fedoraproject fedora | = 27 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
| redhat enterprise linux compute node eus | = 7.4 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux eus | = 7.4 | No fix listed |
| redhat enterprise linux eus | = 7.6 | No fix listed |
| redhat enterprise linux eus | = 7.7 | No fix listed |
| redhat enterprise linux for ibm z systems | = 7.0 | No fix listed |
| redhat enterprise linux for ibm z systems eus | = 7.4 | No fix listed |
| redhat enterprise linux for power big endian | = 7.0 | No fix listed |
| redhat enterprise linux for power big endian eus | = 7.4 | No fix listed |
| redhat enterprise linux for power little endian eus | = 7.4 | No fix listed |
| redhat enterprise linux for real time | = 7.0 | No fix listed |
| redhat enterprise linux for real time for nfv | = 7 | No fix listed |
Show 8 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux for scientific computing | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server tus | = 7.4 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.7 | No fix listed |
| redhat enterprise linux server update services for sap solutions | = 7.4 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- USN-3617-1 vendor-advisory
- USN-3617-2 vendor-advisory
- USN-3617-3 vendor-advisory
- USN-3619-1 vendor-advisory
- USN-3619-2 vendor-advisory
- USN-3632-1 vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2017-15129 vendor-advisory
- git.kernel.org patch
- seclists.org mailing-list third-party-advisory
- 102485 broken-link vdb-entry
- RHSA-2018:0654 third-party-advisory vendor-advisory
- RHSA-2018:0676 third-party-advisory vendor-advisory
- RHSA-2018:1062 third-party-advisory vendor-advisory
- RHSA-2019:1946 third-party-advisory vendor-advisory
- access.redhat.com third-party-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- github.com patch
- marc.info mailing-list patch third-party-advisory
- marc.info mailing-list third-party-advisory
- USN-3617-1 third-party-advisory vendor-advisory
- USN-3617-2 third-party-advisory vendor-advisory
- USN-3617-3 third-party-advisory vendor-advisory
- USN-3619-1 third-party-advisory vendor-advisory
- USN-3619-2 third-party-advisory vendor-advisory
- USN-3632-1 third-party-advisory vendor-advisory
- www.kernel.org release-notes