CVE-2017-15129

Fixed in a distro release EPSS <1%

A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely.

Published 2018-01-09 · CVE record · OSV

Products: linux_kernel, fedoraproject fedora, canonical ubuntu_linux, redhat enterprise_linux, redhat enterprise_linux_compute_node_eus, redhat enterprise_linux_desktop, redhat enterprise_linux_eus, redhat enterprise_linux_for_ibm_z_systems, redhat enterprise_linux_for_ibm_z_systems_eus, redhat enterprise_linux_for_power_big_endian, redhat enterprise_linux_for_power_big_endian_eus, redhat enterprise_linux_for_power_little_endian_eus, redhat enterprise_linux_for_real_time, redhat enterprise_linux_for_real_time_for_nfv, redhat enterprise_linux_for_scientific_computing, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_tus, redhat enterprise_linux_server_update_services_for_sap_solutions, redhat enterprise_linux_workstation

Distro releases