CVE-2017-8824: Use After Free
Last updated 4 July 2026
Other sources
The dccpdisconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AFUNSPEC connect system call during the DCCPLISTEN state.
— Launchpad
Use-after-free vulnerability was found in DCCP socket code affecting kernel since at least 2.6.16, potentially allowing attacker to cause privilege escalation.
References:
http://www.openwall.com/lists/oss-security/2017/12/05/1 http://www.spinics.net/lists/netdev/msg469985.html
http://lists.openwall.net/netdev/2017/12/04/224
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=69c64866ce072dea1d1e59a0d61e0f66c0dffb76
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Configuration
Add the listed lines to /etc/modprobe.d/blacklist-dccp.conf to blacklist dccp ipv[46] autoloading aliases (net-pf-* dccp related aliases set to off).
Linux kernel module autoloading (modprobe) for DCCP /etc/modprobe.d/blacklist-dccp.conf = alias net-pf-10-proto-0-type-6 off; alias net-pf-10-proto-33-type-6 off; alias net-pf-2-proto-0-type-6 off; alias net-pf-2-proto-33-type-6 off
Event History
Frequently Asked Questions
What is the severity of CVE-2017-8824?
CVE-2017-8824 is classified as a high severity vulnerability due to the potential for privilege escalation or denial of service.
How do I fix CVE-2017-8824?
To fix CVE-2017-8824, users should upgrade to a patched version of the Linux kernel, specifically versions above 4.14.20.
Who is affected by CVE-2017-8824?
CVE-2017-8824 affects local users of the Linux kernel versions up to 4.14.3.
What type of vulnerability is CVE-2017-8824?
CVE-2017-8824 is a use-after-free vulnerability that can be exploited during the DCCP_LISTEN state.
How does CVE-2017-8824 allow exploitation?
CVE-2017-8824 can be exploited via an AF_UNSPEC connect system call, potentially leading to privilege escalation.