Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Linux kernel before 4.13.6 lets local user increase privileges

CVE-2017-15649 · published 9 years ago
Summary

The Linux kernel version prior to 4.13.6 contains a flaw in its packet handling code that can be triggered by a local user making specially crafted system calls. This race condition can cause the system to free memory too early, allowing the attacker to gain higher privileges on the machine. Update the kernel to version 4.13.6 or later to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
linux linux_kernel <= 4.13.5
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Original advisory text
net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race ...
net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than CVE-2017-6346.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-362Race Condition
Timeline
Published19 Oct 2017
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-15649 · NVD
Track software like this
Free during beta