What’s Vulnerable › Vulnerabilities

CVE-2017-16939

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-11-24 · updated 2026-06-17
• Weakness: CWE-416

Description

The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages.

Affected products

• Debian Linux: 8.0
• Linux kernel: from 2.6.28 before 3.2.97; from 3.3 before 3.16.52; from 3.17 before 3.18.86; from 3.19 before 4.1.48; from 4.2 before 4.4.104; from 4.5 before 4.9.60 — fixed in 3.16.52, 3.18.86, 3.2.97, 4.1.48, 4.13.11, 4.4.104

How to fix

Upgrade to a fixed version: Linux kernel 3.16.52, 3.18.86, 3.2.97, 4.1.48. Check the vendor advisory for mitigations.

References

• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1137b5e2529a8f5ca8ee709288ecba3e68044df2
• http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html
• http://seclists.org/fulldisclosure/2017/Nov/40
• http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.11
• http://www.securityfocus.com/bid/101954
• https://access.redhat.com/errata/RHSA-2018:1318
• https://access.redhat.com/errata/RHSA-2018:1355
• https://access.redhat.com/errata/RHSA-2019:1170
• https://access.redhat.com/errata/RHSA-2019:1190
• https://blogs.securiteam.com/index.php/archives/3535
• https://bugzilla.suse.com/show_bug.cgi?id=1069702
• https://github.com/torvalds/linux/commit/1137b5e2529a8f5ca8ee709288ecba3e68044df2

Get alerted when CVE-2017-16939 or the next vulnerability affects your stack