CVE-2017-6074
The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structure
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 2 on Exploit-DB, 2 proofs of concept on GitHub
Summary
The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call.
Timeline
- CVE published
- Public exploit on Exploit-DB
EDB-41457, EDB-41458
- Record last updated
Affected versions
- n/a n/a
Version range not reported
References 29
rhn.redhat.com
- errata/RHSA-2017-0323.html
- errata/RHSA-2017-0324.html
- errata/RHSA-2017-0365.html
- errata/RHSA-2017-0347.html
- errata/RHSA-2017-0501.html
- errata/RHSA-2017-0316.html
- errata/RHSA-2017-0294.html
- errata/RHSA-2017-0295.html
- errata/RHSA-2017-0366.html
- errata/RHSA-2017-0346.html
- errata/RHSA-2017-0403.html
- errata/RHSA-2017-0293.html
- errata/RHSA-2017-0345.html