huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2017-3735: openssl: Malformed X.509 IPAdressFamily could cause OOB read
Component: openssl
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2017-08-28T00:00:00+00:00

While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.

Statement: This flaw only exhibits itself when:
1. OpenSSL is used to display details of a local or a remote certificate.
2. The certificate contains the uncommon RFC 3779 IPAddressFamily extension.

The maximum impact of this flaw is garbled information being displayed, there is no impact on the availability of service using such a certificate. Also this flaw can NOT be used to create specially-crafted certificates. Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: 1.1.0, 1.0.2
Fixed upstream versions: OpenSSL_1_1_0g
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 068b963bb7afc57f5bdd723de0dd15e7795d5822
CVE-2017-3736: openssl: bn_sqrx8x_internal carry bug on x86_64
Component: openssl
Severity: Moderate
CWE: CWE-682 (Incorrect Calculation)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2017-11-02T00:00:00+00:00

There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.


Affected upstream versions: 1.1.0 - 1.1.0f, 1.0.2 - 1.0.2l
Fixed upstream versions: OpenSSL_1_1_0g
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 4443cf7aa0099e5ce615c18cee249fff77fb0871
CVE-2017-3737: openssl: Read/write after SSL object in error state
Component: openssl
Severity: Moderate
CWE: CWE-391 (Unchecked Error Condition)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2017-12-07T00:00:00+00:00

OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL 1.0.2n. OpenSSL 1.1.0 is not affected.


Affected upstream versions: 1.0.2b-1.0.2m
Fixed upstream versions: OpenSSL_1_0_2n
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 898fb884b706aaeb283de4812340bb0bde8476dc
CVE-2017-3738: openssl: rsaz_1024_mul_avx2 overflow bug on x86_64
Component: openssl
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2017-12-07T00:00:00+00:00

There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). Note: The impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. OpenSSL version 1.0.2-1.0.2m and 1.1.0-1.1.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue we are not issuing a new release of OpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h when it becomes available. The fix is also available in commit e502cc86d in the OpenSSL git repository.


Affected upstream versions: 1.0.2-1.02m, 1.1.0-1.1.0g
Fixed upstream versions: OpenSSL_1_1_0h
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: e502cc86df9dafded1694fceb3228ee34d11c11a
CVE-2017-5029: chromium-browser: integer overflow in libxslt
Component: chromium-browser
Severity: Important
CVSS v3: 8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2017-03-09T00:00:00+00:00

The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.


Affected upstream versions: Google Chrome prior to 57.0.2987.98 for Mac, Windows and Linux, and 57.0.2987.108 for Android
Fixed upstream versions: v1.1.30
Upstream repository: https://git.gnome.org/browse/libxslt
Upstream fix commit: 08ab2774b870de1c7b5a48693df75e8154addae5
CVE-2017-5130: chromium-browser: heap overflow in libxml2
Component: chromium-browser
Severity: Important
CVSS v3: 8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2017-10-17T00:00:00+00:00

A heap overflow flaw was found in the libxml2 library. An application compiled with libxml2 using the vulnerable debug-only function xmlMemoryStrdup could be used by an attacker to crash the application or execute arbitrary code with the permission of the user running the application.

Statement: This issue does not affect the libxml library shipped with Red Hat Enterprise Linux because the affected code xmlMemoryStrdup() is a debug-only function that should never be called in production builds. The only exception is xmllint when invoked with --maxmem. The same issue applies to the other two affected functions namely xmlMallocLoc and xmlReallocLoc.

Affected upstream versions: Google Chrome prior to 62.0.3202.62
Fixed upstream versions: v2.9.5
Upstream repository: https://git.gnome.org/browse/libxml2
Upstream fix commit: 897dffbae322b46b83f99a607d527058a72c51ed
CVE-2017-5332: icoutils: Access to unallocated memory possible in extract.c
Component: icoutils
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 2.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)
Public date: 2017-01-08T00:00:00+00:00

A vulnerability was found in icoutils, in the wrestool program. An attacker could create a crafted executable that, when read by wrestool, could result in failure to allocate memory or an over-large memcpy operation, leading to a crash.


Affected upstream versions: before 0.31.1
Upstream repository: https://git.savannah.gnu.org/cgit/icoutils.git
Upstream fix commit: 1aa9f28f7bcbdfff6a84a15ac8d9a87559b1596a
CVE-2017-5333: icoutils: Integer overflow vulnerability in extract.c
Component: icoutils
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 8.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L)
Public date: 2017-01-08T00:00:00+00:00

A vulnerability was found in icoutils, in the wrestool program. An attacker could create a crafted executable that, when read by wrestool, could result in memory corruption leading to a crash or potential code execution.


Affected upstream versions: before 0.31.1
Upstream repository: https://git.savannah.gnu.org/cgit/icoutils.git
Upstream fix commit: 1a108713ac26215c7568353f6e02e727e6d4b24a
CVE-2017-5334: gnutls: Double-free while decoding crafted X.509 certificates
Component: gnutls
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2017-01-10T00:00:00+00:00

A double-free flaw was found in the way GnuTLS parsed certain X.509 certificates with Proxy Certificate Information extension. An attacker could create a specially-crafted certificate which, when processed by an application compiled against GnuTLS, could cause that application to crash.


Affected upstream versions: n/a
Fixed upstream versions: gnutls_3_6_0
Upstream repository: https://gitlab.com/gnutls/gnutls
Upstream fix commit: c5aaa488a3d6df712dc8dff23a049133cab5ec1b
CVE-2017-5335: gnutls: Out of memory while parsing crafted OpenPGP certificate
Component: gnutls
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2017-01-10T00:00:00+00:00

The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate.


Affected upstream versions: n/a
Fixed upstream versions: gnutls_3_6_0
Upstream repository: https://gitlab.com/gnutls/gnutls
Upstream fix commit: 49be4f7b82eba2363bb8d4090950dad976a77a3a
CVE-2017-5336: gnutls: Stack overflow in cdk_pk_get_keyid
Component: gnutls
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2017-01-10T00:00:00+00:00

Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.


Affected upstream versions: n/a
Fixed upstream versions: gnutls_3_6_0
Upstream repository: https://gitlab.com/gnutls/gnutls
Upstream fix commit: 5140422e0d7319a8e2fe07f02cbcafc4d6538732
CVE-2017-5337: gnutls: Heap read overflow in read-packet.c
Component: gnutls
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2017-01-10T00:00:00+00:00

Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.


Affected upstream versions: n/a
Fixed upstream versions: gnutls_3_6_0
Upstream repository: https://gitlab.com/gnutls/gnutls
Upstream fix commit: 94fcf1645ea17223237aaf8d19132e004afddc1a
CVE-2017-5340: php: Use of uninitialized memory in unserialize()
Component: php
Severity: Moderate
CWE: CWE-456 (Missing Initialization of a Variable)
CVSS v3: 8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-12-29T00:00:00+00:00

Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data.


Affected upstream versions: n/a
Fixed upstream versions: php-7.0.15
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 4cc0286f2f3780abc6084bcdae5dce595daa3c12
CVE-2017-5551: kernel: S_ISGD is not cleared when setting posix ACLs in tmpfs (CVE-2016-7097 incomplete fix)
Component: kernel
Severity: Moderate
CWE: CWE-287 (Improper Authentication)
CVSS v3: 4.4 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Public date: 2017-01-09T00:00:00+00:00

A vulnerability was found in the Linux kernel in 'tmpfs' file system. When file permissions are modified via 'chmod' and the user is not in the owning group or capable of CAP_FSETID, the setgid bit is cleared in inode_change_ok(). Setting a POSIX ACL via 'setxattr' sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in a similar way; this allows to bypass the check in 'chmod'.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

This flaw was fixed in the Red Hat products as a part of the CVE-2016-7097 fix.

Affected upstream versions: n/a
Fixed upstream versions: v4.10
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 497de07d89c1410d76a15bec2bb41f24a2a89f31
CVE-2017-5579: Qemu: serial: host memory leakage 16550A UART emulation
Component: Qemu
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 4.1 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L)
Public date: 2017-01-11T00:00:00+00:00

Memory leak in the serial_exit_core function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.0
Upstream repository: https://git.qemu-project.org/qemu.git
Upstream fix commit: 8409dc884a201bf74b30a9d232b6bbdd00cb7e2b
CVE-2017-5581: tigervnc: Buffer overflow in ModifiablePixelBuffer::fillRect
Component: tigervnc
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 3.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2017-01-13T00:00:00+00:00

A buffer overflow flaw, leading to memory corruption, was found in TigerVNC viewer. A remote malicious VNC server could use this flaw to crash the client vncviewer process resulting in denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v1.7.90
Upstream repository: https://github.com/TigerVNC/tigervnc
Upstream fix commit: 18c020124ff1b2441f714da2017f63dba50720ba
CVE-2017-5884: gtk-vnc: Improper check of framebuffer boundaries when processing a tile
Component: gtk-vnc
Severity: Low
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 3.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2017-02-01T00:00:00+00:00

It was found that gtk-vnc lacked proper bounds checking while processing messages using RRE, hextile, or copyrect encodings. A remote malicious VNC server could use this flaw to crash VNC viewers which are based on the gtk-vnc library.


Affected upstream versions: n/a
Fixed upstream versions: v0.7.0
Upstream repository: https://git.gnome.org/browse/gtk-vnc
Upstream fix commit: ea0386933214c9178aaea9f2f85049ea3fa3e14a
CVE-2017-5885: gtk-vnc: Integer overflow when processing SetColorMapEntries
Component: gtk-vnc
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 3.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2017-02-01T00:00:00+00:00

An integer overflow flaw was found in gtk-vnc. A remote malicious VNC server could use this flaw to crash VNC viewers which are based on the gtk-vnc library.


Affected upstream versions: n/a
Fixed upstream versions: v0.7.0
Upstream repository: https://git.gnome.org/browse/gtk-vnc
Upstream fix commit: c8583fd3783c5b811590fcb7bae4ce6e7344963e
CVE-2017-5898: Qemu: usb: integer overflow in emulated_apdu_from_guest
Component: Qemu
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 4 (CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L)
Public date: 2017-02-03T00:00:00+00:00

An integer overflow flaw was found in Quick Emulator (QEMU) in the CCID Card device support. The flaw could occur while passing messages via command/response packets to and from the host. A privileged user inside a guest could use this flaw to crash the QEMU process.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.0
Upstream repository: https://git.qemu-project.org/qemu.git
Upstream fix commit: c7dfbf322595ded4e70b626bf83158a9f3807c6a
CVE-2017-5970: kernel: ipv4: Invalid IP options could cause skb->dst drop
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2017-02-04T00:00:00+00:00

A vulnerability was found in the Linux kernel where having malicious IP options present would cause the ipv4_pktinfo_prepare() function to drop/free the dst. This could result in a system crash or possible privilege escalation.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 as the code which can trigger the flaw is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.10
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 34b2cef20f19c87999fff3da4071e66937db9644
CVE-2017-5973: Qemu: usb: infinite loop while doing control transfer in xhci_kick_epctx
Component: Qemu
Severity: Low
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 3 (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L)
Public date: 2017-02-13T00:00:00+00:00

The xhci_kick_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors related to control transfer descriptor sequence.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.0
Upstream repository: https://git.qemu-project.org/qemu.git
Upstream fix commit: f89b60f6e5fee3923bedf80e82b4e5efc1bb156b
CVE-2017-5986: kernel: Reachable BUG_ON from userspace in sctp_wait_for_sndbuf
Component: kernel
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-02-06T00:00:00+00:00

It was reported that with Linux kernel, earlier than version v4.10-rc8, an application may trigger a BUG_ON in sctp_wait_for_sndbuf if the socket tx buffer is full, a thread is waiting on it to queue more data, and meanwhile another thread peels off the association being used by the first thread.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 and MRG-2. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7. This flaw may affect multiple containers running on this system. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.10
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 2dcab598484185dea7ec22219c76dcdd59e3cb90
CVE-2017-6001: kernel: Race condition between multiple sys_perf_event_open() calls
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2017-01-14T00:00:00+00:00

It was found that the original fix for CVE-2016-6786 was incomplete. There exist a race between two concurrent sys_perf_event_open() calls when both try and move the same pre-existing software group into a hardware context.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 as the perf subsystem where the flaw was found is not present in this product.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.10
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 321027c1fe77f892f4ea07846aeae08cefbbb290
CVE-2017-6059: mod_auth_openidc: Shows user-supplied content on error pages
Component: mod_auth_openidc
Severity: Low
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2017-01-18T00:00:00+00:00

A text injection flaw was found in how mod_auth_openidc handled error pages. An attacker could potentially use this flaw to conduct content spoofing and phishing attacks by tricking users into opening specially crafted URLs.


Affected upstream versions: n/a
Fixed upstream versions: v2.1.4
Upstream repository: https://github.com/pingidentity/mod_auth_openidc
Upstream fix commit: 612e309bfffd6f9b8ad7cdccda3019fc0865f3b4
CVE-2017-6074: kernel: use after free in dccp protocol
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2017-02-22T00:00:00+00:00

A use-after-free flaw was found in the way the Linux kernel's Datagram Congestion Control Protocol (DCCP) implementation freed SKB (socket buffer) resources for a DCCP_PKT_REQUEST packet when the IPV6_RECVPKTINFO option is set on the socket. A local, unprivileged user could use this flaw to alter the kernel memory, allowing them to escalate their privileges on the system.

Statement: This issue affects Red Hat Enterprise Linux 5, 6, 7, and Red Hat Enterprise MRG 2 kernels.

As this issue is rated as Important, it has been scheduled to be fixed in a future version of Red Hat Enterprise Linux 5, 6, 7, and Red Hat Enterprise MRG 2  kernels.

Affected upstream versions: n/a
Fixed upstream versions: v4.10
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 5edabca9d4cff7f1f2b68f0bac55ef99d9798ba4