PT-2017-17017 · Linux+2 · Linux Kernel+2

Ben Hutchings · Published 2017-02-25 · Updated 2018-07-09 · CVE-2017-6353

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 4.10.1

Description The issue allows local users to cause a denial of service, specifically an invalid unlock and double free, via a multithreaded application. This is due to the improper restriction of association peel-off operations during certain wait states in net/sctp/socket.c.

Recommendations For Linux kernel versions through 4.10.1, update to a version that includes the correct fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

ALT-PU-2017-1299

ALT-PU-2018-1991

CVE-2017-6353

DLA-849-1

DSA-3804-1

MGASA-2017-0063

MGASA-2017-0064

MGASA-2017-0065

OPENSUSE-SU-2017_0906-1

OPENSUSE-SU-2017_0907-1

SUSE-SU-2017:1183-1

SUSE-SU-2017:1247-1

SUSE-SU-2017:1301-1

SUSE-SU-2017:1360-1

SUSE-SU-2017:1990-1

SUSE-SU-2017:2342-1

SUSE-SU-2017:2525-1

Affected Products

Alt Linux

Linux Kernel

Suse

References · 642

• https://github.com/torvalds/linux/commit/dfcb9f4f99f1e9a49e43398a7bfbf56927544af1 · Patch
• https://cve.org/CVERecord?id=CVE-2017-6353 · Security Note
• https://osv.dev/vulnerability/DSA-3804-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-6353 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0063.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:1247-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-6353 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1183-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0065 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6353 · Security Note
• https://osv.dev/vulnerability/MGASA-2017-0063 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6353 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6353 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1990-1 · Vendor Advisory
• http://debian.org/security/2017/dsa-3804 · Vendor Advisory