PT-2017-14784 · Linux+5 · Linux Kernel+5

Kevin Cernekee · Published 2017-12-06 · Updated 2024-06-15 · CVE-2017-17449

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.14.5

Description The issue allows local users to obtain sensitive information by leveraging the CAP NET ADMIN capability to sniff an nlmon interface for all Netlink activity on the system. This is due to the netlink deliver tap skb function in net/netlink/af netlink.c not restricting observations of Netlink messages to a single net namespace when CONFIG NLMON is enabled.

Recommendations For Linux kernel versions prior to 4.14.5, update to version 4.14.5 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2017-2788

ALT-PU-2018-1991

CESA-2018_1062

CVE-2017-17449

DSA-4073-1

DSA-4082-1

OPENSUSE-SU-2017_3358-1

OPENSUSE-SU-2017_3359-1

OPENSUSE-SU-2024:10728-1

OPENSUSE-SU-2024:13704-1

RHSA-2018:0654

RHSA-2018:0676

RHSA-2018:1062

RHSA-2018:1130

RHSA-2018:1170

RHSA-2018_0676

RHSA-2018_1062

SUSE-SU-2017:3398-1

SUSE-SU-2017:3410-1

SUSE-SU-2018:0031-1

SUSE-SU-2018:0115-1

SUSE-SU-2018:0213-1

USN-3619-1

USN-3619-2

USN-3653-1

USN-3653-2

USN-3655-1

USN-3655-2

USN-3657-1

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

Ubuntu

References · 525

• https://ubuntu.com/security/notices/USN-3653-2 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-17449 · Security Note
• https://ubuntu.com/security/CVE-2017-17806 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-17449 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5333 · Vendor Advisory
• https://usn.ubuntu.com/3619-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3657-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-13305 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3619-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-17449 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-17975 · Vendor Advisory
• https://debian.org/security/2018/dsa-4082 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-17805 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-7492 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-18079 · Vendor Advisory