CVE-2017-15129: Race Condition
A use-after-free vulnerability was found in a network namespaces code affecting the Linux kernel since v4.0-rc1 through v4.15-rc5. The function getnetnsbyid() does not check for the net::count value after it has found a peer network in netnsids idr which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
References:
https://marc.info/?l=linux-netdev&m=151370451121029&w=2
https://marc.info/?t=151370468900001&r=1&w=2 (a whole thread)
http://seclists.org/oss-sec/2018/q1/7
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=21b5944350052d2583e82dd59b19a9ba94a007f0
Other sources
A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function getnetnsbyid() in net/core/netnamespace.c does not check for the net::count value after it has found a peer network in netnsids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-15129?
CVE-2017-15129 is a use-after-free vulnerability found in the Linux kernel before version 4.14.11.
How severe is CVE-2017-15129?
CVE-2017-15129 has a severity level of medium.
How does CVE-2017-15129 impact Linux systems?
CVE-2017-15129 can lead to a double free and may allow an attacker to execute arbitrary code or cause a denial of service.
Which Linux kernel versions are affected by CVE-2017-15129?
Linux kernel versions before 4.14.11 are affected by CVE-2017-15129.
Is there a fix for CVE-2017-15129?
Yes, updating the Linux kernel to version 4.14.11 or later fixes CVE-2017-15129.