PT-2017-10816 · Linux+5 · Linux Kernel+5
Andrey Konovalov
·
Published
2017-08-10
·
Updated
2025-09-29
·
CVE-2017-1000112
CVSS v3.1
7.0
High
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to the fixed version
Description
The issue is related to a memory corruption vulnerability due to a UFO to non-UFO path switch. This occurs when building a UFO packet with MSG MORE, and the append path can be switched from UFO to non-UFO between two send() calls. As a result, a memory corruption can happen, particularly when UFO packet lengths exceed MTU. This leads to out-of-bounds writing by skb copy and csum bits(). A similar issue is present in IPv6 code. The bug was introduced on Oct 18, 2005.
Recommendations
For Linux kernel versions prior to the fixed version, consider applying a patch to fix the memory corruption issue due to UFO to non-UFO path switch. As a temporary workaround, consider restricting the use of MSG MORE when building UFO packets to minimize the risk of exploitation.
Exploit
Fix
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Linux Kernel
Red Hat
Suse
Ubuntu