UBUNTU-CVE-2017-16939
Dashboard / Vulnerabilities / UBUNTU-CVE-2017-16939
UBUNTU-CVE-2017-16939
Summary:
Details: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages.
References: https://ubuntu.com/security/CVE-2017-16939, http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1137b5e2529a8f5ca8ee709288ecba3e68044df2, http://seclists.org/fulldisclosure/2017/Nov/40, http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.11, https://blogs.securiteam.com/index.php/archives/3535, https://bugzilla.suse.com/show_bug.cgi?id=1069702, https://github.com/torvalds/linux/commit/1137b5e2529a8f5ca8ee709288ecba3e68044df2, https://ubuntu.com/security/notices/USN-3511-1, https://ubuntu.com/security/notices/USN-3510-1, https://ubuntu.com/security/notices/USN-3510-2, https://ubuntu.com/security/notices/USN-3509-1, https://ubuntu.com/security/notices/USN-3509-2, https://ubuntu.com/security/notices/USN-3508-1, https://ubuntu.com/security/notices/USN-3508-2, https://ubuntu.com/security/notices/USN-3507-1, https://ubuntu.com/security/notices/USN-3507-2, https://www.cve.org/CVERecord?id=CVE-2017-16939
Affected packages
Package
Name: linux
Purl: pkg:deb/ubuntu/[email protected]?arch=source&distro=trusty
Affected ranges
Type: ECOSYSTEM
Events:
