CVE-2017-7558: High severity Linux Linux kernel vulnerability
A kernel data leak due to an out-of-bound read was found in Linux kernel in inetdiagmsgsctp{,l}addrfill() and sctpgetsctpinfo() functions present since v4.7-rc1 upto v4.13 including. A data leak happens when these functions fill in sockaddr data structures used to export socket's diagnostic information. As a result upto 100 bytes of the slab data could be leaked to a userspace.
References:
http://seclists.org/oss-sec/2017/q3/338
https://marc.info/?t=150348787500002&r=1&w=2
Proposed upstream patch:
https://marc.info/?l=linux-netdev&m=150348777122761&w=2
Other sources
A kernel data leak due to an out-of-bound read was found in the Linux kernel in inetdiagmsgsctp{,l}addrfill() and sctpgetsctpinfo() functions present since version 4.7-rc1 through version 4.13. A data leak happens when these functions fill in sockaddr data structures used to export socket's diagnostic information. As a result, up to 100 bytes of the slab data could be leaked to a userspace.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
Which systems are affected by this issue?
Linux kernel versions from 4.7-rc1 through 4.13, inclusive, are affected. The issue is in SCTP socket diagnostic-information handling.
What does an attacker need to exploit it?
The CVSS vector indicates network access is sufficient, with low attack complexity and no required privileges or user interaction. Successful exploitation can leak up to 100 bytes of kernel slab data to userspace.
What is the impact of successful exploitation?
This is an information-disclosure issue: it can expose kernel slab data. The provided CVSS vector rates confidentiality impact as high and does not indicate integrity or availability impact.
What should teams do to remediate the issue?
Apply the available patch. The supplied data does not identify a workaround or mitigation for systems that cannot be patched immediately.