CVE-2017-11176: Use After Free
Last updated 29 November 2024
Other sources
The mqnotify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact.
— Launchpad
The mqnotify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to possibly cause a situation where a value may be used after being freed (Use after free) which may lead to memory corruption or other unspecified other impact.
Upstream patch:
https://github.com/torvalds/linux/commit/f991af3daabaecff34684fd51fac80319d1baad1
Mitre advisory: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11176
What is use after free: https://access.redhat.com/use-after-free-flaw-type
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2017-11176?
CVE-2017-11176 is a vulnerability in the Linux kernel that allows attackers to cause a denial of service or have unspecified other impact.
How severe is CVE-2017-11176?
CVE-2017-11176 has a severity rating of medium.
What software versions are affected by CVE-2017-11176?
CVE-2017-11176 affects Linux kernel versions 3.13.0-135.184, 4.4.0-93.116, 4.10.0-38.42, and 4.13~.
How can I fix CVE-2017-11176?
To fix CVE-2017-11176, update your Linux kernel to a version that includes the patch.
Where can I find more information about CVE-2017-11176?
You can find more information about CVE-2017-11176 on the CVE website and the Red Hat website.