CVE-2013-7446: Use After Free
A flaw was found in the Linux kernels implementation of Unix sockets. A server polling for data coming from a client socket may put the peer socket on a wait list. This peer may close the connection making the reference on the wait list no longer valid. This could lead to bypssing the permissions on a unix socket, and packets being injected into the stream. This may also panic the machine.
Additional resources:
https://groups.google.com/forum/#!topic/syzkaller/3twDUI4Cpm8
http://seclists.org/oss-sec/2015/q4/321
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=7d267278a9ece963d77eefec61630223fce08c6c
Other sources
Use-after-free vulnerability in net/unix/afunix.c in the Linux kernel before 4.3.3 allows local users to bypass intended AFUNIX socket permissions or cause a denial of service (panic) via crafted epollctl calls.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2013-7446?
CVE-2013-7446 is a use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel before 4.3.3.
How does CVE-2013-7446 affect the Linux kernel?
CVE-2013-7446 allows local users to bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl calls.
What is the severity of CVE-2013-7446?
CVE-2013-7446 has a severity level of medium.
Which versions of the Linux kernel are affected by CVE-2013-7446?
The Linux kernel versions before 4.3.3 are affected by CVE-2013-7446.
How can I fix CVE-2013-7446?
To fix CVE-2013-7446, you need to update your Linux kernel to version 4.3.3 or later.