CVE-2017-15129
Severity
4.7MEDIUM
EPSS
0.1%
top 76.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 9
Latest updateMay 14
Description
A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation ca…
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.0 | Impact: 3.6
Affected Packages7 packages
Also affects: Ubuntu Linux 14.04, 16.04, 17.10, Enterprise Linux 7.0, 7.4, 7.6, 7.7, 7, Fedora 27
Patches
🔴Vulnerability Details
4GHSA▶
GHSA-9324-w9gg-mxf6: A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4↗2022-05-14
OSV▶
CVE-2017-15129: A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4↗2018-01-09
CVEList▶
CVE-2017-15129: A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4↗2018-01-09