CRITICAL Introduced in 2.6.33
net Recvmmsg UAF
CVE-2016-7117
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI9.8CRITICAL
01Description
Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel before 4.5.2 allows remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing.
02KernelScan AI Analysis
Risk summary
A vulnerable kernel can suffer a use-after-free while processing a multi-message socket receive that ends in an error, potentially causing a denial of service or kernel-level code execution. A remote peer can trigger the condition against an affected network-facing socket when another process is using the batch receive operation.
Vulnerability analysis
During a batch receive, the original code could receive one or more messages and then encounter an error. It could release the socket's last reference before recording that pending error, causing the remaining error handling to access freed kernel memory and potentially crash the kernel or execute code. The fix keeps the socket alive until error handling is complete and only then releases it. A remote peer with connectivity to a socket being processed by the batch receive operation can trigger the sequence without special privileges or special hardware, provided a receiving process is actively using the normal socket operation.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 3.10 | 2.6.33 | 3.10.102 | 8ba9ba1ab9b1 |
| 4.5 | 2.6.33 | 4.5.2 | — |
| 5.10 | 2.6.33 | 5.10.181 | 1b33bdd76635 |
| 5.15 | 2.6.33 | 5.15.113 | 159a81d5e5a9 |
| 5.4 | 2.6.33 | 5.4.244 | 1747aa98ab13 |
| 6.1 | 2.6.33 | 6.1.30 | bd0f360ee864 |
| mainline | 2.6.33 | 4.6-rc1 | 34b88a68f26a |
| cip/4.4 | 2.6.33 | 4.4.42-cip1 | 405f10a39443 |
| cip/4.4-rt | 2.6.33 | 4.4.75-cip6-rt1 | 405f10a39443 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/4.4 | Fixed in 4.4.42-cip1 |
| cip/4.4-rt | Fixed in 4.4.75-cip6-rt1 |