Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.7
CVE-2017-17449: Linux kernel lets local user view all Netlink messages
CVE-2017-17449 · published 8 years ago
Summary
Versions of the Linux kernel up to 4.14.4 that have the optional netlink monitoring feature (CONFIG_NLMON) enabled can allow a user with network‑admin rights to see every Netlink communication on the machine. This could expose internal system details to a malicious insider. Fix the issue by updating the kernel to a patched version or disabling the netlink monitoring feature in the kernel configuration.
What to do
- Update canonical linux to version 3.13.0-149.199.
- Update canonical linux-aws to version 4.4.0-1016.16.
- Update canonical linux-lts-xenial to version 4.4.0-119.143~14.04.1.
- Update canonical linux to version 4.4.0-119.143.
- Update canonical linux-aws to version 4.4.0-1054.63.
- Update canonical linux-azure to version 4.13.0-1018.21.
- Update canonical linux-gcp to version 4.13.0-1017.21.
- Update canonical linux-hwe to version 4.13.0-43.48~16.04.1.
- Update canonical linux-kvm to version 4.4.0-1020.25.
- Update canonical linux-oem to version 4.13.0-1028.31.
- Update canonical linux-raspi2 to version 4.4.0-1086.94.
- Update canonical linux-snapdragon to version 4.4.0-1088.93.
- Update canonical linux-fips to version 4.4.0-1008.10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
<= 4.14.4 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Ubuntu:14.04:LTS | canonical | linux |
< 3.13.0-149.199 Fix: upgrade to 3.13.0-149.199
|
| Ubuntu:14.04:LTS | canonical | linux-aws |
< 4.4.0-1016.16 Fix: upgrade to 4.4.0-1016.16
|
| Ubuntu:14.04:LTS | canonical | linux-lts-xenial |
< 4.4.0-119.143~14.04.1 Fix: upgrade to 4.4.0-119.143~14.04.1
|
| Ubuntu:16.04:LTS | canonical | linux |
< 4.4.0-119.143 Fix: upgrade to 4.4.0-119.143
|
| Ubuntu:16.04:LTS | canonical | linux-aws |
< 4.4.0-1054.63 Fix: upgrade to 4.4.0-1054.63
|
| Ubuntu:16.04:LTS | canonical | linux-azure |
< 4.13.0-1018.21 Fix: upgrade to 4.13.0-1018.21
|
| Ubuntu:16.04:LTS | canonical | linux-gcp |
< 4.13.0-1017.21 Fix: upgrade to 4.13.0-1017.21
|
| Ubuntu:16.04:LTS | canonical | linux-hwe |
< 4.13.0-43.48~16.04.1 Fix: upgrade to 4.13.0-43.48~16.04.1
|
| Ubuntu:16.04:LTS | canonical | linux-kvm |
< 4.4.0-1020.25 Fix: upgrade to 4.4.0-1020.25
|
| Ubuntu:16.04:LTS | canonical | linux-oem |
< 4.13.0-1028.31 Fix: upgrade to 4.13.0-1028.31
|
| Ubuntu:16.04:LTS | canonical | linux-raspi2 |
< 4.4.0-1086.94 Fix: upgrade to 4.4.0-1086.94
|
| Ubuntu:16.04:LTS | canonical | linux-snapdragon |
< 4.4.0-1088.93 Fix: upgrade to 4.4.0-1088.93
|
| Ubuntu:Pro:FIPS-updates:16.04:LTS | canonical | linux-fips |
< 4.4.0-1008.10 Fix: upgrade to 4.4.0-1008.10
|
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
Original advisory text
The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single n...
The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system.
References
- http://www.securityfocus.com/bid/102122 Third Party Advisory VDB Entry
- https://access.redhat.com/errata/RHSA-2018:0654
- https://access.redhat.com/errata/RHSA-2018:0676
- https://access.redhat.com/errata/RHSA-2018:1062
- https://access.redhat.com/errata/RHSA-2018:1130
- https://access.redhat.com/errata/RHSA-2018:1170
- https://source.android.com/security/bulletin/pixel/2018-04-01
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3653-1/
- https://usn.ubuntu.com/3653-2/
- https://usn.ubuntu.com/3655-1/
- https://usn.ubuntu.com/3655-2/
- https://usn.ubuntu.com/3657-1/
- https://www.debian.org/security/2017/dsa-4073
- https://www.debian.org/security/2018/dsa-4082
- https://lkml.org/lkml/2017/12/5/950 Third Party Advisory
- https://ubuntu.com/security/CVE-2017-17449 Third Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=93c6476... Third Party Advisory
- https://ubuntu.com/security/notices/USN-3619-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-3619-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-3653-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-3653-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-3655-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-3655-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-3657-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2017-17449 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-200Information Exposure
Timeline
Published6 Dec 2017
Updated4 Nov 2026
First seen29 Sep 2026
Track software like this
Free during beta