CVE-2017-7184

Published: 19 March 2017

The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, which allows local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-image-* package 4.8.0.41.52.

From the Ubuntu Security Team

It was discovered that the xfrm framework for transforming packets in the Linux kernel did not properly validate data received from user space. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code with administrative privileges.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

Severity score breakdown

References

• http://www.eweek.com/security/ubuntu-linux-falls-on-day-1-of-pwn2own-hacking-competition
• https://blog.trendmicro.com/results-pwn2own-2017-day-one/
• https://twitter.com/thezdi/status/842126074435665920
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=52b9c816807abd46c285cd8ab183fe93194bfb3f
• https://git.kernel.org/linus/677e806da4d916052585301785d847c3b3e6186a
• https://git.kernel.org/linus/f843ee6dd019bcece3e74e76ad9df0155655d0df
• https://ubuntu.com/security/notices/USN-3250-2
• https://ubuntu.com/security/notices/USN-3251-1
• https://ubuntu.com/security/notices/USN-3251-2
• https://ubuntu.com/security/notices/USN-3249-2
• https://ubuntu.com/security/notices/USN-3249-1
• https://ubuntu.com/security/notices/USN-3250-1
• https://ubuntu.com/security/notices/USN-3248-1
• https://www.cve.org/CVERecord?id=CVE-2017-7184
• NVD
• Launchpad
• Debian