CVE-2017-8890
The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.41% probability · 71th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-415
- Affected
- linux/linux kernel · debian/debian linux
- Source
- cve@mitre.org
References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=657831ffc38e30092a2d5f03d385d710eb88b09aIssue Tracking, Patch, Third Party Advisory
- http://www.debian.org/security/2017/dsa-3886Third Party Advisory
- http://www.securityfocus.com/bid/98562Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2017:1842Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2077Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2669Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1854Third Party Advisory
- https://github.com/torvalds/linux/commit/657831ffc38e30092a2d5f03d385d710eb88b09aIssue Tracking, Patch, Third Party Advisory
- https://source.android.com/security/bulletin/2017-09-01Third Party Advisory
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=657831ffc38e30092a2d5f03d385d710eb88b09aIssue Tracking, Patch, Third Party Advisory
- http://www.debian.org/security/2017/dsa-3886Third Party Advisory
- http://www.securityfocus.com/bid/98562Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2017:1842Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2077Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2669Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1854Third Party Advisory
- https://github.com/torvalds/linux/commit/657831ffc38e30092a2d5f03d385d710eb88b09aIssue Tracking, Patch, Third Party Advisory
- https://source.android.com/security/bulletin/2017-09-01Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.