vulnwire
7.8high

CVE-2017-111761 exploit

The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic.

Published 9 y ago · modified 4 mo ago · JSON

CVSS
7.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
3.8%
percentile 90%
Public exploits
1
Exploit-DB

The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact.

Exploit prediction (EPSS)

3.85% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.

Exploits and detections

  • EDB-45553 Linux Kernel < 4.11.8 - 'mq_notify: double sock_put()' Local Privilege Escalation · local · 2018-10-02

CVSS scores

Assigned byVersionScoreVector
NVD3.17.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
Technology feeds
Linux kernel (RSS, critical only)

References

  • debian.org /security/2017/dsa-3927 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • access.redhat.com /errata/RHSA-2018:0169 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2017:2918 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2017:2931 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • help.ecostruxureit.com /display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/99919 · vdb-entry, x_refsource_BID, x_transferred
  • github.com /torvalds/linux/commit/f991af3daabaecff34684fd51fac80319d1baad1 · x_refsource_CONFIRM, x_transferred
  • debian.org /security/2017/dsa-3945 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • exploit-db.com /exploits/45553/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • git.kernel.org /cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f991af3daabaecff34684fd51fac80319d1ba · x_refsource_CONFIRM, x_transferred
  • access.redhat.com /errata/RHSA-2018:3822 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2017:2930 · vendor-advisory, x_refsource_REDHAT, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.