CVE-2016-10200: Use After Free
A flaw was found on the linux kernel which enables a race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCKZAPPED status, related to net/l2tp/l2tpip.c and net/l2tp/l2tpip6.c.
Upstream patch:
https://github.com/torvalds/linux/commit/32c231164b76
Follow-up upstream patches:
https://github.com/torvalds/linux/commit/0382a25af3c7 https://github.com/torvalds/linux/commit/a3c18422a4b4 https://github.com/torvalds/linux/commit/d5e3a190937a https://github.com/torvalds/linux/commit/df90e6886146 https://github.com/torvalds/linux/commit/31e2f21fb35b
Merge commit of the above series:
https://github.com/torvalds/linux/commit/7752f72748db
Another follow-up upstream patch:
https://github.com/torvalds/linux/commit/94d7ee0baa8b
References:
https://source.android.com/security/bulletin/2017-03-01.html
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2016-10200.
What is the severity of CVE-2016-10200?
CVE-2016-10200 has a severity level of critical.
How does CVE-2016-10200 impact Linux kernel before 4.8.14?
CVE-2016-10200 allows local users to gain privileges or cause a denial of service (use-after-free) through a race condition in the L2TPv3 IP Encapsulation feature.
Which software versions are affected by CVE-2016-10200?
The Linux kernel versions before 4.8.14 are affected by CVE-2016-10200.
How can I fix CVE-2016-10200?
To fix CVE-2016-10200, update your Linux kernel to version 4.8.14 or later.