ALERT: Patch to address vulnerability in Linux (CVE-2017-6074)

A vulnerability affecting the Linux kernel's Datagram Congestion Control Protocol (DCCP) IPv6 implementation allows an attacker to create a situation where memory can be overwritten with malicious instructions. An attacker must have access to a local account on the system and both DCCP and IPv6 must be enabled, which is the default on most major Linux distributions. Action should be taken quickly to mitigate this vulnerability on vulnerable systems.

A non-privileged user can use this Linux kernel vulnerability to gain root access on vulnerable systems. Shared systems that allow logins from users who should not have root access are exposed to exploitation of this vulnerability. Proof-of-concept (POC) code is expected to be made publicly available within a few days if it is not already available.

Proof-of-concept (POC) code is expected to be publicly available within a few days if it is not already available. This flaw allows an attacker with an account on the local system to potentially elevate privileges. Successful exploitation may result in crashing of the host kernel, potential execution of code in the context of the host kernel or other escalation of privilege by modifying kernel memory structures.

A Linux system is vulnerable if the kernel was compiled with DCCP and IPv6 support and the kernel version is earlier than the fixed version. On most systems, compilation of the kernel with DCCP and IPv6 support will result in the creation of the file /lib/modules/[KERNEL VERSION]/kernel/net/dccp/dccp_ipv6.ko

This file will also exist on patched systems, so check with your Linux distribution to find the kernel version or kernel package version that fixes this vulnerability.

Complete kernel patching after appropriate testing as soon as a patch is available. A reboot will be required following patching. Prioritize shared systems that allow logins from users who should not have local root access.

If immediate patching is not possible, consider disabling the DCCP kernel module. The following method is recommended for some distributions, but please see your Linux distribution’s documentation to determine the recommended methods for disabling kernel modules.

# echo "install dccp /bin/true">> /etc/modprobe.d/disable-dccp.conf

If the DCCP kernel module is already loaded, a reboot will likely be necessary to protect the system after making that change.

A use-after-free flaw was found in the way the Linux kernel's DCCP implementation freed SKB (socket buffer) resources for a DCCP_PKT_REQUEST packet when the IPV6_RECVPKTINFO option is set on the socket. A local, unprivileged user could use this flaw to alter the kernel memory, allowing them to escalate their privileges on the system.

Linux systems managed by ITS will be patched or reconfigured as soon as possible. If you manage Linux devices for yourself or others, please patch or reconfigure as soon as possible.

In general, the best protection for your devices is this: keep your software and apps up-to-date, do not click suspicious links in email, do not open shared documents or email attachments unless you are expecting them and trust the person who sent them, and only use secure, trusted networks. For more information, see Phishing, and Suspicious Email, Secure Your Devices, and Use a Secure Internet Connection on the U-M Safe Computing website.

Please contact [email protected].

• CVE-2017-6074 (Red Hat)
• Use-after-free in the IPv6 implementation of the DCCP protocol in the Linux kernel - CVE-2017-6074 (Red Hat)
• Eleven-year-old root flaw found and patched in the Linux kernel (PC World)
• Linux kernel: CVE-2017-6074: DCCP double-free vulnerability (local root) (oss-security mail list)
• dccp: fix freeing skb too early for IPV6_RECVPKTINFO (kernel.org)