Malicious local users may gain escalated privileges to execute arbitrary code by exploiting a vulnerability in the Linux Kernel.
PUBLISH DATE: 16-11-2018
A security flaw in the Linux Kernel may be exploited by malicious local users to gain kernel privileges. It could then be used to induce a use-after-free condition on the system, or execute arbitrary code using Kernel privileges. Updates are available for all the affected versions of the product.
A race condition error within the “packet_do_bind()” function (net/packet/af_packet.c) can be exploited to trigger a use-after-free error. Successful exploitation may allow execution of arbitrary code with kernel privileges.
In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition.
The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by a packet_notifier register action. Later, packet_release operates on only one of the two applicable linked lists. The attacker can achieve Program Counter control.
An unprivileged, local user could use this flaw to trigger kernel memory corruption, making the system crash or go unresponsive. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.
Linux Kernel 3.16.x
Linux Kernel 4.4.x
Linux Kernel 4.9.x
Linux Kernel 4.14.x
Update the following affected versions according to the suggested updates available.
Update to version 4.14.7 or later.
Update to version 4.9.70 or later.
Update to version 4.4.106 or later.
Update to version 3.16.55 or later.
If you think you are a victim of a cyber-attack, immediately send an e-mail to email@example.com.