PT-2017-7798 · Linux+5 · Linux Kernel+5

Andrey Konovalov + 1 · Published 2016-12-11 · Updated 2023-06-07 · CVE-2016-10200

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.8.14

Description A race condition exists in the L2TPv3 IP Encapsulation feature, allowing local users to gain privileges or cause a denial of service. This issue is related to the net/l2tp/l2tp ip.c and net/l2tp/l2tp ip6.c files. The problem occurs when multiple bind system calls are made without properly checking whether a socket has the SOCK ZAPPED status, resulting in a use-after-free condition.

Recommendations For Linux kernel versions prior to 4.8.14, update to version 4.8.14 or later to resolve the issue.

Fix

DoS

Race Condition

Use After Free

Weakness Enumeration

CWE-362

CWE-264

CWE-416

Related Identifiers

ALT-PU-2016-2436

ALT-PU-2016-2437

CESA-2017_1842

CVE-2016-10200

DLA-922-1

OPENSUSE-SU-2017_0906-1

OPENSUSE-SU-2017_0907-1

RHSA-2017:1842

RHSA-2017:2077

RHSA-2017:2437

RHSA-2017:2444

RHSA-2017_1842

RHSA-2017_2077

SUSE-SU-2017:1183-1

SUSE-SU-2017:1247-1

SUSE-SU-2017:1301-1

SUSE-SU-2017:1360-1

SUSE-SU-2017:1990-1

SUSE-SU-2017:2342-1

SUSE-SU-2017:2525-1

USN-3422-1

USN-3422-2

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

Ubuntu

References · 651

• https://github.com/torvalds/linux/commit/32c231164b762dddefa13af5a0101032c70b50ef · Patch
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=32c231164b762dddefa13af5a0101032c70b50ef · Patch
• https://linux.oracle.com/errata/ELSA-2017-3607.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2077 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2017-3606.html · Vendor Advisory
• http://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.14 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8650 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10200 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7472 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2437 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10044 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1247-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1183-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3422-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2017-1842-1.html · Vendor Advisory