CVE-2017-18509
published 2019-08-13CVE-2017-18509: An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.84%
54.2th percentile
An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels before 4.9.187.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 4.11.6-1 (bookworm) | linux 4.11.6-1 (bookworm) |
| android | — | — | |
| linux | linux_kernel | < 3.16.72 | 3.16.72 |
| linux | linux_kernel | >= 0 < 4.11.6-1 | 4.11.6-1 |
| linux | linux_kernel | >= 0 < 4.11.6-1 | 4.11.6-1 |
| linux | linux_kernel | >= 0 < 4.11.6-1 | 4.11.6-1 |
| linux | linux_kernel | >= 0 < 4.11.6-1 | 4.11.6-1 |
| linux | linux_kernel | >= 0 < 4.4.0-165.193 | 4.4.0-165.193 |
| linux | linux_kernel | >= 3.17 < 4.4.187 | 4.4.187 |
| linux | linux_kernel | >= 4.10 < 4.11 | 4.11 |
| linux | linux_kernel | >= 4.5 < 4.9.187 | 4.9.187 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SIMATIC
cisa_ics·2024-03-14
Siemens SIMATIC
ICS Advisory
##
Siemens SIMATIC
Release DateMarch 14, 2024
Alert CodeICSA-24-074-07
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC
- Vulnerabilities: Improper Restriction of Operations within the Bounds of a Memory Buffer, Improper Input Validation, Missing Encryption of Sensitive Data, Incorrect Permission Assignment for Critical Resource, Expected Beha
Android
CVE-2017-18509: IPv6 multicast
vendor_android·2021-02-01·CVSS 7.8
CVE-2017-18509 [HIGH] CVE-2017-18509: IPv6 multicast
Android Security Bulletin 2021-02-01
CVE: CVE-2017-18509
Severity: HIGH
Type: EoP
Component: IPv6 multicast
References: A-172999675
Upstream kernel
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-10-01·CVSS 7.8
CVE-2016-10905 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that a race condition existed in the GFS2 file system in
the Linux kernel. A local attacker could possibly use this to cause a
denial of service (system crash). (CVE-2016-10905)
It was discovered that the IPv6 implementation in the Linux kernel did not
properly validate socket options in some situations. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-18509)
It was discovered that the USB gadget Midi driver in the Linux kernel
contained a double-free vulnerability when handling certain error
conditions. A local attacker could use this to cause a denial of service
(system crash). (CVE-2018-20961)
Red Hat
kernel: not checking sk_type and protocol in net/ipv6/ip6mr.c leads to general protection fault, or arbitrary code execution
vendor_redhat·2019-08-20·CVSS 7.8
CVE-2017-18509 [HIGH] CWE-843 kernel: not checking sk_type and protocol in net/ipv6/ip6mr.c leads to general protection fault, or arbitrary code execution
kernel: not checking sk_type and protocol in net/ipv6/ip6mr.c leads to general protection fault, or arbitrary code execution
An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels before 4.9.187.
A flaw was found in the Linux kernel’s net/
Debian
CVE-2017-18509: linux - An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By ...
vendor_debian·2017·CVSS 7.8
CVE-2017-18509 [HIGH] CVE-2017-18509: linux - An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By ...
An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels before 4.9.187.
Scope: local
bookworm: resolved (fixed in 4.11.6-1)
bullseye: resolved (fixed in 4.11.6-1)
forky: resolved (fixed in 4.11.6-1)
sid: resolved (fixed in 4.11.6-1)
trixie: r
GHSA
GHSA-32qx-4wxm-fcw8: An issue was discovered in net/ipv6/ip6mr
ghsa_unreviewed·2022-05-24
CVE-2017-18509 [HIGH] CWE-20 GHSA-32qx-4wxm-fcw8: An issue was discovered in net/ipv6/ip6mr
An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels.
OSV
CVE-2017-18509: In ip6_mroute_setsockopt and related functions of ip6mr
osv·2021-02-01
CVE-2017-18509 CVE-2017-18509: In ip6_mroute_setsockopt and related functions of ip6mr
In ip6_mroute_setsockopt and related functions of ip6mr.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
OSV
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
osv·2019-10-01·CVSS 7.8
CVE-2016-10905 [HIGH] linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that a race condition existed in the GFS2 file system in
the Linux kernel. A local attacker could possibly use this to cause a
denial of service (system crash). (CVE-2016-10905)
It was discovered that the IPv6 implementation in the Linux kernel did not
properly validate socket options in some situations. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-18509)
It was discovered that the USB gadget Midi driver in the Linux kernel
contained a double-free vulnerability when handling certain error
conditions. A local attacker could use this to cause a denial of service
(system crash). (CVE-2018-20961)
It was discovered that th
OSV
CVE-2017-18509: An issue was discovered in net/ipv6/ip6mr
osv·2019-08-13·CVSS 7.8
CVE-2017-18509 [HIGH] CVE-2017-18509: An issue was discovered in net/ipv6/ip6mr
An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels before 4.9.187.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-18509 kernel: not checking sk_type and protocol in net/ipv6/ip6mr.c leads to general protection fault, or arbitrary code execution [fedora-all]
bugzilla·2019-08-21·CVSS 7.8
CVE-2017-18509 [HIGH] CVE-2017-18509 kernel: not checking sk_type and protocol in net/ipv6/ip6mr.c leads to general protection fault, or arbitrary code execution [fedora-all]
CVE-2017-18509 kernel: not checking sk_type and protocol in net/ipv6/ip6mr.c leads to general protection fault, or arbitrary code execution [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
f
Bugzilla
CVE-2017-18509 kernel: not checking sk_type and protocol in net/ipv6/ip6mr.c leads to general protection fault, or arbitrary code execution [fedora-all]
bugzilla·2019-08-21·CVSS 7.8
CVE-2017-18509 [HIGH] CVE-2017-18509 kernel: not checking sk_type and protocol in net/ipv6/ip6mr.c leads to general protection fault, or arbitrary code execution [fedora-all]
CVE-2017-18509 kernel: not checking sk_type and protocol in net/ipv6/ip6mr.c leads to general protection fault, or arbitrary code execution [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
f
Bugzilla
CVE-2017-18509 kernel: not checking sk_type and protocol in net/ipv6/ip6mr.c leads to general protection fault, or arbitrary code execution
bugzilla·2019-08-20·CVSS 7.8
CVE-2017-18509 [HIGH] CVE-2017-18509 kernel: not checking sk_type and protocol in net/ipv6/ip6mr.c leads to general protection fault, or arbitrary code execution
CVE-2017-18509 kernel: not checking sk_type and protocol in net/ipv6/ip6mr.c leads to general protection fault, or arbitrary code execution
By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. This affects Linux distributions that use 4.9.x longterm kernels before 4.9.187.
External References:
https://pulsesecurity.co.nz/advisories/linux-kernel-4.9-inetcsklistenstop-gpf
Upstream Patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=99253eb750fda6a644d5188fb26c43bad8d5a745
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1743914]
---
Created kernel tracking bug
http://packetstormsecurity.com/files/154059/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlhttps://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=99253eb750fda6a644d5188fb26c43bad8d5a745https://github.com/torvalds/linux/commit/99253eb750fda6a644d5188fb26c43bad8d5a745https://lists.debian.org/debian-lts-announce/2019/08/msg00016.htmlhttps://lists.debian.org/debian-lts-announce/2019/08/msg00017.htmlhttps://lists.openwall.net/netdev/2017/12/04/40https://pulsesecurity.co.nz/advisories/linux-kernel-4.9-inetcsklistenstop-gpfhttps://salsa.debian.org/kernel-team/linux/commit/baefcdc2f29923e7325ce4e1a72c3ff0a9800f32https://seclists.org/bugtraq/2019/Aug/26https://support.f5.com/csp/article/K41582535https://support.f5.com/csp/article/K41582535?utm_source=f5support&%3Butm_medium=RSShttps://usn.ubuntu.com/4145-1/https://www.debian.org/security/2019/dsa-4497http://packetstormsecurity.com/files/154059/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.htmlhttps://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=99253eb750fda6a644d5188fb26c43bad8d5a745https://github.com/torvalds/linux/commit/99253eb750fda6a644d5188fb26c43bad8d5a745https://lists.debian.org/debian-lts-announce/2019/08/msg00016.htmlhttps://lists.debian.org/debian-lts-announce/2019/08/msg00017.htmlhttps://lists.openwall.net/netdev/2017/12/04/40https://pulsesecurity.co.nz/advisories/linux-kernel-4.9-inetcsklistenstop-gpfhttps://salsa.debian.org/kernel-team/linux/commit/baefcdc2f29923e7325ce4e1a72c3ff0a9800f32https://seclists.org/bugtraq/2019/Aug/26https://support.f5.com/csp/article/K41582535https://support.f5.com/csp/article/K41582535?utm_source=f5support&%3Butm_medium=RSShttps://usn.ubuntu.com/4145-1/https://www.debian.org/security/2019/dsa-4497
2019-08-13
Published