CVE-2017-11600
published 2017-07-24CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is…
PriorityP427high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.41%
33.4th percentile
net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.12.6-1 (bookworm) | linux 4.12.6-1 (bookworm) |
| linux | linux_kernel | >= 0 < 4.12.6-1 | 4.12.6-1 |
| linux | linux_kernel | >= 0 < 4.12.6-1 | 4.12.6-1 |
| linux | linux_kernel | >= 0 < 4.12.6-1 | 4.12.6-1 |
| linux | linux_kernel | >= 0 < 4.12.6-1 | 4.12.6-1 |
| linux | linux_kernel | >= 2.6.21 < 3.2.93 | 3.2.93 |
| linux | linux_kernel | >= 3.11 < 3.18.70 | 3.18.70 |
| linux | linux_kernel | >= 3.19 < 4.1.45 | 4.1.45 |
| linux | linux_kernel | >= 3.3 < 3.10.108 | 3.10.108 |
| linux | linux_kernel | >= 4.10 < 4.12.11 | 4.12.11 |
| linux | linux_kernel | >= 4.2 < 4.4.87 | 4.4.87 |
| linux | linux_kernel | >= 4.5 < 4.9.48 | 4.9.48 |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv7.0HIGH
vendor_debian7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cr28-cmmc-g8hr: net/xfrm/xfrm_policy
ghsa_unreviewed·2022-05-14
CVE-2017-11600 [HIGH] CWE-125 GHSA-cr28-cmmc-g8hr: net/xfrm/xfrm_policy
net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message.
Kernel
xfrm: policy: check policy direction value
kernel_security·2017-08-02·CVSS 7.0
CVE-2017-11600 [HIGH] xfrm: policy: check policy direction value
xfrm: policy: check policy direction value
The 'dir' parameter in xfrm_migrate() is a user-controlled byte which is used
as an array index. This can lead to an out-of-bound access, kernel lockup and
DoS. Add a check for the 'dir' value.
This fixes CVE-2017-11600.
References: https://bugzilla.redhat.com/show_bug.cgi?id=1474928
Fixes: 80c9abaabf42 ("[XFRM]: Extension for dynamic update of endpoint address(es)")
Cc: # v2.6.21-rc1
Reported-by: "bo Zhang"
Signed-off-by: Vladis Dronov
Signed-off-by: Steffen Klassert
OSV
CVE-2017-11600: net/xfrm/xfrm_policy
osv·2017-07-24·CVSS 7.0
CVE-2017-11600 [HIGH] CVE-2017-11600: net/xfrm/xfrm_policy
net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message.
Red Hat
kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message
vendor_redhat·2017-07-11·CVSS 7.0
CVE-2017-11600 [HIGH] CWE-125 kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message
kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message
net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message.
The xfrm_migrate() function in the net/xfrm/xfrm_policy.c file in the Linux kernel built with CONFIG_XFRM_MIGRATE does not verify if the dir parameter is less than XFRM_POLICY_MAX. This allows a local attacker to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact by sending a XFRM_MSG_MIGRATE netlink message. This flaw is present in the
Debian
CVE-2017-11600: linux - net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGR...
vendor_debian·2017·CVSS 7.0
CVE-2017-11600 [HIGH] CVE-2017-11600: linux - net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGR...
net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message.
Scope: local
bookworm: resolved (fixed in 4.12.6-1)
bullseye: resolved (fixed in 4.12.6-1)
forky: resolved (fixed in 4.12.6-1)
sid: resolved (fixed in 4.12.6-1)
trixie: resolved (fixed in 4.12.6-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-11600 kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message
bugzilla·2017-07-25·CVSS 7.0
CVE-2017-11600 [HIGH] CVE-2017-11600 kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message
CVE-2017-11600 kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message
xfrm_migrate() function in net/xfrm/xfrm_policy.c file in the Linux kernel build with CONFIG_XFRM_MIGRATE does not check that the dir parameter is less than XFRM_POLICY_MAX. This allows a local attacker cause a denial of service (out-of-bounds access) or possibly have unspecified other impact by sending a XFRM_MSG_MIGRATE netlink message. This flaw is present in the Linux kernel since an introduction of XFRM_MSG_MIGRATE in 2.6.21-rc1 and upto 4.13-rc3.
References:
http://seclists.org/bugtraq/2017/Jul/30
http://marc.info/?t=150169629800003&r=1&w=2
http://marc.info/?l=linux-netdev&m=150169627919528&w=2
Suggested upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec.git/com
Bugzilla
CVE-2017-11600 kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message [fedora-all]
bugzilla·2017-07-25·CVSS 7.0
CVE-2017-11600 [HIGH] CVE-2017-11600 kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message [fedora-all]
CVE-2017-11600 kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mul
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.htmlhttp://seclists.org/bugtraq/2017/Jul/30http://www.debian.org/security/2017/dsa-3981http://www.securityfocus.com/bid/99928https://access.redhat.com/errata/RHSA-2018:1965https://access.redhat.com/errata/RHSA-2018:2003https://access.redhat.com/errata/RHSA-2019:1170https://access.redhat.com/errata/RHSA-2019:1190https://source.android.com/security/bulletin/pixel/2017-11-01http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.htmlhttp://seclists.org/bugtraq/2017/Jul/30http://www.debian.org/security/2017/dsa-3981http://www.securityfocus.com/bid/99928https://access.redhat.com/errata/RHSA-2018:1965https://access.redhat.com/errata/RHSA-2018:2003https://access.redhat.com/errata/RHSA-2019:1170https://access.redhat.com/errata/RHSA-2019:1190https://source.android.com/security/bulletin/pixel/2017-11-01
2017-07-24
Published