CVE-2017-11600: High severity linux kernel vulnerability
net/xfrm/xfrmpolicy.c in the Linux kernel through 4.12.3, when CONFIGXFRMMIGRATE is enabled, does not ensure that the dir value of xfrmuserpolicyid is XFRMPOLICYMAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRMMSGMIGRATE xfrm Netlink message.
Other sources
xfrmmigrate() function in net/xfrm/xfrmpolicy.c file in the Linux kernel build with CONFIGXFRMMIGRATE does not check that the dir parameter is less than XFRMPOLICYMAX. This allows a local attacker cause a denial of service (out-of-bounds access) or possibly have unspecified other impact by sending a XFRMMSGMIGRATE netlink message. This flaw is present in the Linux kernel since an introduction of XFRMMSGMIGRATE in 2.6.21-rc1 and upto 4.13-rc3.
References:
http://seclists.org/bugtraq/2017/Jul/30
http://marc.info/?t=150169629800003&r=1&w=2
http://marc.info/?l=linux-netdev&m=150169627919528&w=2
Suggested upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec.git/commit/?id=7bab09631c2a303f87a7eb7e3d69e888673b9b7e
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7bab09631c2a303f87a7eb7e3d69e888673b9b7e
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-11600?
CVE-2017-11600 has a medium severity rating due to its potential to cause a denial of service.
How do I fix CVE-2017-11600?
To fix CVE-2017-11600, ensure that your Linux kernel is upgraded to a version later than 4.12.3 that includes the necessary patches.
Which systems are affected by CVE-2017-11600?
CVE-2017-11600 affects Linux kernel versions prior to 4.12.3 when CONFIG_XFRM_MIGRATE is enabled.
What are the risks associated with CVE-2017-11600?
The risks associated with CVE-2017-11600 include potential denial of service and out-of-bounds memory access.
Is there a workaround for CVE-2017-11600?
A temporary workaround for CVE-2017-11600 involves disabling the CONFIG_XFRM_MIGRATE option if it is not needed.