CVE-2017-14497: Buffer Overflow
A buffer overflow was discovered in tpacketrcv() function in the Linux kernel since v4.6-rc1 through v4.13. A number of socket-related syscalls can be made to set up a configuration when each packet received by a network interface can cause writing up to 10 bytes to a kernel memory outside of a kernel buffer. This can cause unspecified kernel data corruption effects, including damage of in-memory and on-disk XFS data.
References:
https://marc.info/?l=linux-kernel&m=150394500728906&w=2
https://marc.info/?t=150394517700001&r=1&w=2
http://seclists.org/oss-sec/2017/q3/476
A kernel patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=edbd58be15a957f6a760c4a514cd475217eb97fd
Other sources
The tpacketrcv function in net/packet/afpacket.c in the Linux kernel before 4.13 mishandles vnet headers, which might allow local users to cause a denial of service (buffer overflow, and disk and memory corruption) or possibly have unspecified other impact via crafted system calls.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
Who can exploit this issue?
A local user with low privileges can exploit it. The CVSS vector indicates local access is required, no user interaction is needed, and no prior administrative privileges are required.
What must an attacker do to trigger the vulnerability?
The attacker must use socket-related system calls to create a packet-socket configuration involving vnet headers. Packets received by a network interface can then cause writes of up to 10 bytes outside a kernel buffer.
What are the likely consequences of successful exploitation?
The reported effects include kernel memory corruption, denial of service, and corruption of in-memory or on-disk XFS data. The issue may also have other unspecified impacts.
Which kernel versions are affected, and is a fix available?
The issue is reported from Linux v4.6-rc1 through v4.13, with affected code described as Linux kernel versions before 4.13. A kernel patch is available.