CVE-2017-12153

Published: 21 September 2017

A security flaw was discovered in the nl80211_set_rekey_data() function in net/wireless/nl80211.c in the Linux kernel through 4.13.3. This function does not check whether the required attributes are present in a Netlink request. This request can be issued by a user with the CAP_NET_ADMIN capability and may result in a NULL pointer dereference and system crash.

From the Ubuntu Security Team

Bo Zhang discovered that the netlink wireless configuration interface in the Linux kernel did not properly validate attributes when handling certain requests. A local attacker with the CAP_NET_ADMIN could use this to cause a denial of service (system crash).

Notes

attacker needs CAP_NET_ADMIN either at system level or in a
namespace that also has had a WiFi interface moved into it.

Status

Severity score breakdown

References

• https://marc.info/?t=150525503100001&r=1&w=2
• https://marc.info/?l=linux-wireless&m=150525493517953&w=2
• https://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git/commit/?id=e785fa0a164aa11001cba931367c7f94ffaff888
• https://ubuntu.com/security/notices/USN-3469-1
• https://ubuntu.com/security/notices/USN-3469-2
• https://ubuntu.com/security/notices/USN-3487-1
• https://ubuntu.com/security/notices/USN-3583-1
• https://ubuntu.com/security/notices/USN-3583-2
• https://www.cve.org/CVERecord?id=CVE-2017-12153
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=1491046