CVE-2017-15126
published 2018-01-14CVE-2017-15126: A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is related to the handling of fork failure when dealing with…
PriorityP342high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
4.08%
89.7th percentile
A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is related to the handling of fork failure when dealing with event messages. Failure to fork correctly can lead to a situation where a fork event will be removed from an already freed list of events with userfaultfd_ctx_put().
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.13.10-1 (bookworm) | linux 4.13.10-1 (bookworm) |
| linux | linux_kernel | >= 0 < 4.13.10-1 | 4.13.10-1 |
| linux | linux_kernel | >= 0 < 4.13.10-1 | 4.13.10-1 |
| linux | linux_kernel | >= 0 < 4.13.10-1 | 4.13.10-1 |
| linux | linux_kernel | >= 0 < 4.13.10-1 | 4.13.10-1 |
| linux | linux_kernel | >= 4.11 < 4.13.6 | 4.13.6 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv8.1HIGH
vendor_debian8.1HIGH
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v4mc-2f9f-5jw2: A use-after-free flaw was found in fs/userfaultfd
ghsa_unreviewed·2022-05-14
CVE-2017-15126 [HIGH] CWE-119 GHSA-v4mc-2f9f-5jw2: A use-after-free flaw was found in fs/userfaultfd
A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is related to the handling of fork failure when dealing with event messages. Failure to fork correctly can lead to a situation where a fork event will be removed from an already freed list of events with userfaultfd_ctx_put().
OSV
CVE-2017-15126: A use-after-free flaw was found in fs/userfaultfd
osv·2018-01-14·CVSS 8.1
CVE-2017-15126 [HIGH] CVE-2017-15126: A use-after-free flaw was found in fs/userfaultfd
A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is related to the handling of fork failure when dealing with event messages. Failure to fork correctly can lead to a situation where a fork event will be removed from an already freed list of events with userfaultfd_ctx_put().
Red Hat
kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c
vendor_redhat·2017-12-05·CVSS 8.1
CVE-2017-15126 [HIGH] CWE-119 kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c
kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c
A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is related to the handling of fork failure when dealing with event messages. Failure to fork correctly can lead to a situation where a fork event will be removed from an already freed list of events with userfaultfd_ctx_put().
A flaw was found in the Linux kernel's handling of fork failure when dealing with event messages in the userfaultfd code. Failure to fork correctly can create a fork event that will be removed from an already freed list of events.
Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6.
This issue affects the Linux kernel packag
Debian
CVE-2017-15126: linux - A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4...
vendor_debian·2017·CVSS 8.1
CVE-2017-15126 [HIGH] CVE-2017-15126: linux - A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4...
A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is related to the handling of fork failure when dealing with event messages. Failure to fork correctly can lead to a situation where a fork event will be removed from an already freed list of events with userfaultfd_ctx_put().
Scope: local
bookworm: resolved (fixed in 4.13.10-1)
bullseye: resolved (fixed in 4.13.10-1)
forky: resolved (fixed in 4.13.10-1)
sid: resolved (fixed in 4.13.10-1)
trixie: resolved (fixed in 4.13.10-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-15126 kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c [fedora-all]
bugzilla·2018-02-14·CVSS 8.1
CVE-2017-15126 [HIGH] CVE-2017-15126 kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c [fedora-all]
CVE-2017-15126 kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue
Bugzilla
CVE-2017-15126 kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c
bugzilla·2017-12-08·CVSS 8.1
CVE-2017-15126 [HIGH] CVE-2017-15126 kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c
CVE-2017-15126 kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c
A flaw was found in the Linux kernels handling of fork failure when dealing with event messages in the userfaultfd code. Failure to fork correctly can lead to a situation where a fork event will be removed from an already freed list of events with userfaultfd_ctx_put(). The userfault events are part of the slab cache, and the secondary free could only free other event list objects as the free mechanism uses the underlying kmem_cache_* implementation making generic use-after-free style attacks less effective.
While technically a use after free style flaw, at this time Red Hat Product security believes this flaw to be difficult to exploit but this may change in the future.
From the commit
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=384632e67e0829deb8015ee6ad916b180049d252http://www.securityfocus.com/bid/102516https://access.redhat.com/errata/RHSA-2018:0676https://access.redhat.com/errata/RHSA-2018:1062https://access.redhat.com/security/cve/CVE-2017-15126https://bugzilla.redhat.com/show_bug.cgi?id=1523481https://github.com/torvalds/linux/commit/384632e67e0829deb8015ee6ad916b180049d252https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.6http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=384632e67e0829deb8015ee6ad916b180049d252http://www.securityfocus.com/bid/102516https://access.redhat.com/errata/RHSA-2018:0676https://access.redhat.com/errata/RHSA-2018:1062https://access.redhat.com/security/cve/CVE-2017-15126https://bugzilla.redhat.com/show_bug.cgi?id=1523481https://github.com/torvalds/linux/commit/384632e67e0829deb8015ee6ad916b180049d252https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.6
2018-01-14
Published