CVE-2017-6353: Double Free
net/sctp/socket.c in the Linux kernel through 4.10.1 does not properly restrict association peel-off operations during certain wait states, which allows local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6353?
CVE-2017-6353 is considered a medium severity vulnerability due to its ability to cause a denial of service.
How do I fix CVE-2017-6353?
To fix CVE-2017-6353, update your Linux kernel to version 4.10.2 or later.
Who is affected by CVE-2017-6353?
CVE-2017-6353 affects local users on systems running vulnerable versions of the Linux kernel up to 4.10.1.
What type of attack can CVE-2017-6353 facilitate?
CVE-2017-6353 can facilitate a denial of service attack through invalid unlock and double free conditions in multithreaded applications.
Is CVE-2017-6353 being actively exploited?
As of the last update, there is no evidence that CVE-2017-6353 is being actively exploited in the wild.