A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
History
21 Nov 2024, 03:14
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=21b5944350052d2583e82dd59b19a9ba94a007f0 - Patch | |
| References | () http://seclists.org/oss-sec/2018/q1/7 - Mailing List, Third Party Advisory | |
| References | () http://www.securityfocus.com/bid/102485 - Broken Link | |
| References | () https://access.redhat.com/errata/RHSA-2018:0654 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2018:0676 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2018:1062 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2019:1946 - Third Party Advisory | |
| References | () https://access.redhat.com/security/cve/CVE-2017-15129 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=1531174 - Issue Tracking, Patch, Third Party Advisory | |
| References | () https://github.com/torvalds/linux/commit/21b5944350052d2583e82dd59b19a9ba94a007f0 - Patch | |
| References | () https://marc.info/?l=linux-netdev&m=151370451121029&w=2 - Mailing List, Patch, Third Party Advisory | |
| References | () https://marc.info/?t=151370468900001&r=1&w=2 - Mailing List, Third Party Advisory | |
| References | () https://usn.ubuntu.com/3617-1/ - Third Party Advisory | |
| References | () https://usn.ubuntu.com/3617-2/ - Third Party Advisory | |
| References | () https://usn.ubuntu.com/3617-3/ - Third Party Advisory | |
| References | () https://usn.ubuntu.com/3619-1/ - Third Party Advisory | |
| References | () https://usn.ubuntu.com/3619-2/ - Third Party Advisory | |
| References | () https://usn.ubuntu.com/3632-1/ - Third Party Advisory | |
| References | () https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.11 - Release Notes |
08 Feb 2024, 02:07
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Redhat
Redhat enterprise Linux Redhat enterprise Linux For Power Big Endian Eus Redhat enterprise Linux Eus Redhat enterprise Linux For Power Little Endian Eus Redhat enterprise Linux Server Aus Redhat enterprise Linux Server Update Services For Sap Solutions Redhat enterprise Linux Desktop Redhat enterprise Linux Compute Node Eus Fedoraproject Fedoraproject fedora Redhat enterprise Linux For Real Time Redhat enterprise Linux For Real Time For Nfv Redhat enterprise Linux For Ibm Z Systems Redhat enterprise Linux Server Tus Canonical ubuntu Linux Redhat enterprise Linux For Power Big Endian Redhat enterprise Linux For Ibm Z Systems Eus Redhat enterprise Linux Server Canonical Redhat enterprise Linux Workstation Redhat enterprise Linux For Scientific Computing |
|
| References | (MISC) https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.11 - Release Notes | |
| References | (REDHAT) https://access.redhat.com/errata/RHSA-2018:0676 - Third Party Advisory | |
| References | (UBUNTU) https://usn.ubuntu.com/3617-1/ - Third Party Advisory | |
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1531174 - Issue Tracking, Patch, Third Party Advisory | |
| References | (UBUNTU) https://usn.ubuntu.com/3619-2/ - Third Party Advisory | |
| References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:1946 - Third Party Advisory | |
| References | (REDHAT) https://access.redhat.com/errata/RHSA-2018:0654 - Third Party Advisory | |
| References | (REDHAT) https://access.redhat.com/errata/RHSA-2018:1062 - Third Party Advisory | |
| References | (UBUNTU) https://usn.ubuntu.com/3617-2/ - Third Party Advisory | |
| References | (UBUNTU) https://usn.ubuntu.com/3617-3/ - Third Party Advisory | |
| References | (UBUNTU) https://usn.ubuntu.com/3632-1/ - Third Party Advisory | |
| References | (UBUNTU) https://usn.ubuntu.com/3619-1/ - Third Party Advisory | |
| References | (BID) http://www.securityfocus.com/bid/102485 - Broken Link | |
| CPE | cpe:2.3:o:linux:linux_kernel:4.15:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:4.15:rc3:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_real_time:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.4:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:27:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* cpe:2.3:o:redhat:enterprise_linux_compute_node_eus:7.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:4.15:rc1:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:4.15:rc4:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv:7:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 4.9
v3 : 4.7 |
Information
Published : 2018-01-09 19:29
Updated : 2024-11-21 03:14
NVD link : CVE-2017-15129
Mitre link : CVE-2017-15129
CVE.ORG link : CVE-2017-15129
JSON object : View
Products Affected
redhat
- enterprise_linux_for_power_little_endian_eus
- enterprise_linux_server_tus
- enterprise_linux_for_power_big_endian
- enterprise_linux_for_real_time_for_nfv
- enterprise_linux_for_real_time
- enterprise_linux_compute_node_eus
- enterprise_linux_for_ibm_z_systems_eus
- enterprise_linux_for_scientific_computing
- enterprise_linux_server_aus
- enterprise_linux_server_update_services_for_sap_solutions
- enterprise_linux_desktop
- enterprise_linux_eus
- enterprise_linux_for_power_big_endian_eus
- enterprise_linux_for_ibm_z_systems
- enterprise_linux_workstation
- enterprise_linux_server
- enterprise_linux
canonical
- ubuntu_linux
fedoraproject
- fedora
linux
- linux_kernel
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')