Summary
It was discovered that the xfrm framework for transforming packets in the
Linux kernel did not properly validate data received from user space. A
local attacker could use this to cause a denial of service (system crash)
or execute arbitrary code with administrative privileges.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | linux | 4.4.0-71.92 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-aws | 4.4.0-1012.21 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-gke | 4.4.0-1009.9 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-raspi2 | 4.4.0-1051.58 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-snapdragon | 4.4.0-1054.58 |
Vulnerabilities 1
-
Unscored —CVE-2017-7184 Public exploit
The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certai…
References
-
report
https://ubuntu.com/security/CVE-2017-7184