CVE-2017-15649

net/packet/af_packet.c en versiones anteriores a la 4.13.6 del kernel de Linux permite que usuarios locales obtengan privilegios mediante llamadas manipuladas al sistema que dan lugar a una gestión incorrecta de las estructuras de datos packet_fanout. Esto se debe a una condición de carrera (que afecta a fanout_add y packet_do_bind) que da lugar a un uso de memoria previamente liberada. Esta vulnerabilidad es diferente de CVE-2017-6346.

It was found that fanout_add() in 'net/packet/af_packet.c' in the Linux kernel, before version 4.13.6, allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free bug.

An update that solves two vulnerabilities and has two fixes is now available. This update for the Linux Kernel 4.4.82-6_9 fixes several issues. The following security issues were fixed. Net/packet/af_packet.c in the Linux kernel allowed local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition that leads to a use-after-free, a different vulnerability than CVE-2017-6346 Non security issues fixed. Wi-Fi Protected Access allowed reinstallation of the Group Temporal Key during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.