Bug 1526427 (CVE-2017-17712) - CVE-2017-17712 kernel: Race condition in raw_sendmsg function allows denial-of-service or kernel addresses leak
Summary: CVE-2017-17712 kernel: Race condition in raw_sendmsg function allows denial-o...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-17712
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1526933 1527027 1527028
Blocks: 1525085
TreeView+ depends on / blocked
 
Reported: 2017-12-15 12:43 UTC by Adam Mariš
Modified: 2021-03-11 16:41 UTC (History)
46 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A flaw was found in the Linux kernel's implementation of raw_sendmsg allowing a local attacker to panic the kernel or possibly leak kernel addresses. A local attacker, with the privilege of creating raw sockets, can abuse a possible race condition when setting the socket option to allow the kernel to automatically create ip header values and thus potentially escalate their privileges.
Clone Of:
Environment:
Last Closed: 2019-06-08 03:34:31 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:0502 0 normal SHIPPED_LIVE Important: kernel-alt security and bug fix update 2018-03-13 19:39:22 UTC

Description Adam Mariš 2017-12-15 12:43:09 UTC 
A flaw was found in the kernels implementation of raw_sendmsg allowing a
local attacker to panic the kernel or possible leak kernel addresses. A
local attacker with the privilege of creating raw sockets, can abuse a
possible race condition when setting the socket option to allow the kernel
to automatically create ip header values.

References:

http://seclists.org/oss-sec/2017/q4/401

https://patchwork.ozlabs.org/patch/846641/

An upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8f659a03a0ba9289b9aeb9b4470e6fb263d6f483
Comment 3 Adam Mariš 2017-12-18 08:34:53 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1526933]
Comment 4 Petr Matousek 2017-12-18 11:42:49 UTC 
Statement:

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2 as they do not contain the upstream commit (c008ba5bdc9f) that allows this issue to be exploited.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 for ARM and Red Hat Enterprise Linux for Power LE.

Future Linux kernel updates for the respective releases may address this issue.
Comment 5 Petr Matousek 2017-12-18 11:44:44 UTC 
What is Red Hat Enterprise Linux 7 for ARM 64,
        Red Hat Enterprise Linux 7 for Power 9 LE

The kernel package as shipped with Red Hat Enterprise Linux 7 for ARM 64 and Red Hat Enterprise Linux 7 for Power 9 LE is an updated kernel intended to support new architectures not available at the time of Red Hat Enterprise Linux 7 original shipping. The new kernel version is based on an upstream Linux kernel version 4.11. The offering is distributed with other updated packages, but most of the userspace is the standard Red Hat Enterprise Linux 7 Server RPM files.

For more information please refer to:

https://access.redhat.com/articles/3158541
https://access.redhat.com/articles/3158511
Comment 9 errata-xmlrpc 2018-03-13 15:37:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:0502 https://access.redhat.com/errata/RHSA-2018:0502
Note You need to log in before you can comment on or make changes to this bug.