CVE-2017-6353: Double Free
net/sctp/socket.c in the Linux kernel through 4.10.1 does not properly restrict association peel-off operations during certain wait states, which allows local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6353?
CVE-2017-6353 is considered a medium severity vulnerability due to its ability to cause a denial of service.
How do I fix CVE-2017-6353?
To fix CVE-2017-6353, update your Linux kernel to version 4.10.2 or later.
Who is affected by CVE-2017-6353?
CVE-2017-6353 affects local users on systems running vulnerable versions of the Linux kernel up to 4.10.1.
What type of attack can CVE-2017-6353 facilitate?
CVE-2017-6353 can facilitate a denial of service attack through invalid unlock and double free conditions in multithreaded applications.
Is CVE-2017-6353 being actively exploited?
As of the last update, there is no evidence that CVE-2017-6353 is being actively exploited in the wild.