CVE-2016-7117: Use After Free
A use after free vulnerability was found in the kernels socket recvmsg subsystem. This may allows remote attackers to corrupt memory and may allow execution of arbitrary code. This corruption takes place during the error handling routines within sysrecvmmsg() function.
To attack the kernel using this method the system must be running application using the UDP recvmmsg syscall().
Upstream patch:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=34b88a68f26a75e4fded796f1a49c40f82234b7d
Upstream discussion: https://patchwork.kernel.org/patch/8093221/
Additional Write up: https://blog.lizzie.io/notes-about-cve-2016-7117.html
Other sources
Use-after-free vulnerability in the sysrecvmmsg function in net/socket.c in the Linux kernel before 4.5.2 allows remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-7117?
CVE-2016-7117 is a use-after-free vulnerability in the Linux kernel that allows remote attackers to execute arbitrary code.
Which versions of Linux kernel are affected by CVE-2016-7117?
The Linux kernel versions before 4.5.2 are affected by CVE-2016-7117.
How severe is CVE-2016-7117?
CVE-2016-7117 is classified as a critical vulnerability with a severity score of 9.
How can I fix CVE-2016-7117?
To fix CVE-2016-7117, update your Linux kernel to version 4.5.2 or later.
Where can I find more information about CVE-2016-7117?
You can find more information about CVE-2016-7117 in the references provided: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=34b88a68f26a75e4fded796f1a49c40f82234b7d, http://source.android.com/security/bulletin/2016-10-01.html, http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.5.2.