CVE-2017-5986: Race Condition
It was reported that with Linux kernel, earlier than version v4.10-rc8, an application may trigger a BUGON in sctpwaitforsndbuf if the socket tx buffer is full, a thread is waiting on it to queue more data, and meanwhile another thread peels off the association being used by the first thread.
References:
https://lkml.org/lkml/2017/1/30/238
http://seclists.org/oss-sec/2017/q1/432
Upstream patch:
https://github.com/torvalds/linux/commit/2dcab598484185dea7ec22219c76dcdd59e3cb90
Other sources
Race condition in the sctpwaitforsndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11 allows local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.133-1Fixed in 6.12.22-1 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 4.9.11 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Patch 2dcab598484185dea7ec22219c76dcdd59e3cb90 - Compensating control
Until the system is upgraded, mitigate the denial-of-service risk by limiting local users' ability to trigger the vulnerable multithreaded SCTP behavior (e.g., restrict access to untrusted local users/tenants that could run such workloads).
Event History
Frequently Asked Questions
What is CVE-2017-5986?
CVE-2017-5986 is a vulnerability in the Linux kernel that allows local users to cause a denial of service by triggering a race condition in the sctp_wait_for_sndbuf function.
How severe is CVE-2017-5986?
CVE-2017-5986 has a severity level of medium.
How do I fix CVE-2017-5986?
To fix CVE-2017-5986, update your Linux kernel to version 4.9.11 or higher.
Where can I find more information about CVE-2017-5986?
You can find more information about CVE-2017-5986 at the following references: [https://lkml.org/lkml/2017/1/30/238](https://lkml.org/lkml/2017/1/30/238), [http://seclists.org/oss-sec/2017/q1/432](http://seclists.org/oss-sec/2017/q1/432), [https://github.com/torvalds/linux/commit/2dcab598484185dea7ec22219c76dcdd59e3cb90](https://github.com/torvalds/linux/commit/2dcab598484185dea7ec22219c76dcdd59e3cb90).
What is the CWE of CVE-2017-5986?
CVE-2017-5986 has a Common Weakness Enumeration (CWE) of 362.