USN-3386-1 — linux vulnerabilities

Summary

Andrey Konovalov discovered a race condition in the UDP Fragmentation
Offload (UFO) code in the Linux kernel. A local attacker could use this to
cause a denial of service or execute arbitrary code. (CVE-2017-1000112)

Andrey Konovalov discovered a race condition in AF_PACKET socket option
handling code in the Linux kernel. A local unprivileged attacker could use
this to cause a denial of service or possibly execute arbitrary code.
(CVE-2017-1000111)

Fixed packages 1

Release	Package	Fixed in
Ubuntu · 14.04 LTS 14.04:LTS	linux	3.13.0-128.177

Vulnerabilities 2

Unscored —

CVE-2017-1000111

Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-865…

linux-raspi2 linux-hwe linux-riscv linux Debian Ubuntu

Oct 4, 2017
Unscored —

CVE-2017-1000112 Public exploit EPSS 21%

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE…

linux-raspi2 linux-hwe linux-riscv linux Debian Ubuntu

Oct 4, 2017

References

report
https://ubuntu.com/security/CVE-2017-1000111
report
https://ubuntu.com/security/CVE-2017-1000112

linux vulnerabilities

Summary

Fixed packages 1

Vulnerabilities 2

Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-865…

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE…

References