The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, which allows local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-image-* package 4.8.0.41.52.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | amazon-linux-upgrade-kernel | Mar 30, 2017 | Mar 19, 2017 |
| Centos_linux | — | centos-upgrade-kernelcentos-upgrade-kernel-rt | Oct 25, 2017 | Mar 19, 2017 |
| Debian | debian-upgrade-linux | May 1, 2017 | Mar 19, 2017 | |
| Oracle_linux | — | oracle-linux-upgrade-kerneloracle-linux-upgrade-kernel-uek | Apr 14, 2017 | Mar 29, 2017 |
| Redhat_linux | — | redhat-upgrade-kernelredhat-upgrade-kernel-rt | Oct 25, 2017 | Mar 19, 2017 |
| Suse | — | suse-upgrade-cluster-md-kmp-defaultsuse-upgrade-cluster-network-kmp-defaultsuse-upgrade-dlm-kmp-defaultsuse-upgrade-gfs2-kmp-defaultsuse-upgrade-kernel-defaultsuse-upgrade-kernel-docssuse-upgrade-kernel-ec2suse-upgrade-kernel-ec2-develsuse-upgrade-kernel-ec2-extrasuse-upgrade-kernel-obs-buildsuse-upgrade-ocfs2-kmp-default | Mar 30, 2017 | Mar 19, 2017 |
| Ubuntu | ubuntu-upgrade-linux-image-3-13-0-115-genericubuntu-upgrade-linux-image-3-13-0-115-generic-lpaeubuntu-upgrade-linux-image-3-13-0-115-lowlatencyubuntu-upgrade-linux-image-3-13-0-115-powerpc-e500ubuntu-upgrade-linux-image-3-13-0-115-powerpc-e500mcubuntu-upgrade-linux-image-3-13-0-115-powerpc-smpubuntu-upgrade-linux-image-3-13-0-115-powerpc64-smpubuntu-upgrade-linux-image-3-2-0-125-genericubuntu-upgrade-linux-image-3-2-0-125-generic-paeubuntu-upgrade-linux-image-3-2-0-125-highbankubuntu-upgrade-linux-image-3-2-0-125-omapubuntu-upgrade-linux-image-3-2-0-125-powerpc-smpubuntu-upgrade-linux-image-3-2-0-125-powerpc64-smpubuntu-upgrade-linux-image-3-2-0-125-virtualubuntu-upgrade-linux-image-3-2-0-1503-omap4ubuntu-upgrade-linux-image-4-4-0-1009-gkeubuntu-upgrade-linux-image-4-4-0-1012-awsubuntu-upgrade-linux-image-4-4-0-1051-raspi2ubuntu-upgrade-linux-image-4-4-0-1054-snapdragonubuntu-upgrade-linux-image-4-4-0-71-genericubuntu-upgrade-linux-image-4-4-0-71-generic-lpaeubuntu-upgrade-linux-image-4-4-0-71-lowlatencyubuntu-upgrade-linux-image-4-4-0-71-powerpc-e500mcubuntu-upgrade-linux-image-4-4-0-71-powerpc-smpubuntu-upgrade-linux-image-4-4-0-71-powerpc64-smpubuntu-upgrade-linux-image-4-8-0-1032-raspi2ubuntu-upgrade-linux-image-4-8-0-45-genericubuntu-upgrade-linux-image-4-8-0-45-generic-lpaeubuntu-upgrade-linux-image-4-8-0-45-lowlatencyubuntu-upgrade-linux-image-4-8-0-45-powerpc-e500mcubuntu-upgrade-linux-image-4-8-0-45-powerpc-smpubuntu-upgrade-linux-image-awsubuntu-upgrade-linux-image-genericubuntu-upgrade-linux-image-generic-hwe-16-04ubuntu-upgrade-linux-image-generic-lpaeubuntu-upgrade-linux-image-generic-lpae-hwe-16-04ubuntu-upgrade-linux-image-generic-lpae-lts-trustyubuntu-upgrade-linux-image-generic-lpae-lts-xenialubuntu-upgrade-linux-image-generic-lts-trustyubuntu-upgrade-linux-image-generic-lts-xenialubuntu-upgrade-linux-image-generic-paeubuntu-upgrade-linux-image-gkeubuntu-upgrade-linux-image-highbankubuntu-upgrade-linux-image-lowlatencyubuntu-upgrade-linux-image-lowlatency-hwe-16-04ubuntu-upgrade-linux-image-lowlatency-lts-xenialubuntu-upgrade-linux-image-omapubuntu-upgrade-linux-image-omap4ubuntu-upgrade-linux-image-powerpc-e500ubuntu-upgrade-linux-image-powerpc-e500mcubuntu-upgrade-linux-image-powerpc-e500mc-lts-xenialubuntu-upgrade-linux-image-powerpc-smpubuntu-upgrade-linux-image-powerpc-smp-lts-xenialubuntu-upgrade-linux-image-powerpc64-smpubuntu-upgrade-linux-image-powerpc64-smp-lts-xenialubuntu-upgrade-linux-image-raspi2ubuntu-upgrade-linux-image-snapdragonubuntu-upgrade-linux-image-virtual | Mar 30, 2017 | Mar 19, 2017 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Mar 19, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub