| Revision Date: | 2018-01-09 | Version: | 1 | | Title: | CVE-2017-15129 on Ubuntu 18.04 LTS (bionic) - medium. | | Description: | A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely. It was discovered that a use-after-free vulnerability existed in the network namespaces implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
| | Family: | unix | Class: | vulnerability | | Status: | | Reference(s): | CVE-2017-15129
| | Platform(s): | Ubuntu 18.04 LTS
| Product(s): | | | Definition Synopsis | | Ubuntu 18.04 LTS (bionic) is installed. AND Package Information
linux package in bionic, is related to the CVE in some way and has been fixed (note: '4.15.0-10.11').
OR linux-aws package in bionic, is related to the CVE in some way and has been fixed (note: '4.15.0-1001.1').
OR linux-azure package in bionic, is related to the CVE in some way and has been fixed (note: '4.15.0-1002.2').
OR linux-gcp package in bionic, is related to the CVE in some way and has been fixed (note: '4.15.0-1001.1').
OR linux-kvm package in bionic, is related to the CVE in some way and has been fixed (note: '4.15.0-1002.2').
OR linux-meta package in bionic, is related to the CVE in some way and has been fixed (note: '4.15.0-10.11').
OR linux-meta-aws package in bionic, is related to the CVE in some way and has been fixed (note: '4.15.0-1001.1').
OR linux-meta-azure package in bionic, is related to the CVE in some way and has been fixed (note: '4.15.0-1002.2').
OR linux-meta-gcp package in bionic, is related to the CVE in some way and has been fixed (note: '4.15.0-1001.1').
OR linux-meta-kvm package in bionic, is related to the CVE in some way and has been fixed (note: '4.15.0-1002.2').
OR linux-meta-oem package in bionic, is related to the CVE in some way and has been fixed (note: '4.15.0-1002.3').
OR linux-meta-raspi2 package in bionic, is related to the CVE in some way and has been fixed (note: '4.15.0-1006.7').
OR linux-oem package in bionic, is related to the CVE in some way and has been fixed (note: '4.15.0-1002.3').
OR linux-raspi2 package in bionic, is related to the CVE in some way and has been fixed (note: '4.15.0-1006.7').
OR linux-signed package in bionic, is related to the CVE in some way and has been fixed (note: '4.15.0-10.11').
OR linux-signed-azure package in bionic, is related to the CVE in some way and has been fixed (note: '4.15.0-1002.2').
OR linux-signed-gcp package in bionic, is related to the CVE in some way and has been fixed (note: '4.15.0-1001.1').
OR linux-signed-oem package in bionic, is related to the CVE in some way and has been fixed (note: '4.15.0-1002.3').
|
|