CVE-2017-13686

Description

net/ipv4/route.c in the Linux kernel 4.13-rc1 through 4.13-rc6 is too late to check for a NULL fi field when RTM_F_FIB_MATCH is set, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via crafted system calls. NOTE: this does not affect any stable release.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
linux	17.04 zesty	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected
linux-armadaxp	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-aws	17.04 zesty	Not in release
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected
linux-azure	17.04 zesty	Not in release
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected
linux-euclid	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-flo	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-gcp	17.04 zesty	Not in release
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-gke	17.04 zesty	Not in release
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-goldfish	17.04 zesty	Not affected
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-grouper	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-hwe	17.04 zesty	Not in release
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-hwe-edge	17.04 zesty	Not in release
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-kvm	17.04 zesty	Not in release
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-linaro-omap	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-linaro-shared	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-linaro-vexpress	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-lts-quantal	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-lts-raring	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-lts-saucy	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-lts-trusty	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-lts-utopic	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-lts-vivid	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-lts-wily	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-lts-xenial	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not affected
linux-maguro	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-mako	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-manta	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-qcm-msm	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-raspi2	17.04 zesty	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-snapdragon	17.04 zesty	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-ti-omap4	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release

Notes

tyhicks

The flaw only existed in -rc releases of the kernel

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
linux	Introduced by b617981, fixed by bc3aae2

Severity score breakdown

CVSS version: CVSS v3.0

Base score 7.8 · High

Base metrics

Parameter	Value
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality impact	High
Integrity impact	High
Availability impact	High

Scores

Parameter	Value
Base score	7.8 · High
Exploitability score	-
Impact score	-

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2017-13686

Cvss 3 Severity Score