CVE-2017-18509
📋 TL;DR
This is a Linux kernel vulnerability in IPv6 multicast routing that allows attackers with root privileges or CAP_NET_ADMIN capability to trigger a general protection fault or potentially execute arbitrary code. It affects systems running Linux kernel versions before 4.11, particularly those using 4.9.x longterm kernels before 4.9.187. The vulnerability occurs due to missing sk_type and protocol validation in ip6_mroute_* functions.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to kernel-level code execution, potentially leading to full system compromise.
Likely Case
Kernel panic or denial of service through general protection fault, causing system instability or crashes.
If Mitigated
No impact if proper access controls prevent unauthorized users from gaining root or CAP_NET_ADMIN privileges.
🎯 Exploit Status
Exploit requires local access and appropriate privileges. Proof of concept available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel 4.11 and later, or 4.9.187+ for longterm kernels
Vendor Advisory: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=99253eb750fda6a644d5188fb26c43bad8d5a745
Restart Required: Yes
Instructions:
1. Update Linux kernel to version 4.11 or later. 2. For systems using 4.9.x longterm kernels, update to 4.9.187 or later. 3. Reboot system to load new kernel.
🔧 Temporary Workarounds
Restrict CAP_NET_ADMIN capability
linuxRemove CAP_NET_ADMIN capability from non-privileged users and containers to limit attack surface.
setcap -r cap_net_admin /path/to/binary
docker run --cap-drop=NET_ADMIN ...
Disable IPv6 multicast routing
linuxDisable IPv6 multicast routing if not required for system functionality.
sysctl -w net.ipv6.conf.all.mc_forwarding=0
echo 0 > /proc/sys/net/ipv6/conf/all/mc_forwarding
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized users from gaining root or CAP_NET_ADMIN privileges
- Isolate vulnerable systems in network segments and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check kernel version: uname -r. If version is before 4.11 (or 4.9.x before 4.9.187), system is vulnerable.Check Version:
uname -rVerify Fix Applied:
After patching, verify kernel version is 4.11+ or 4.9.187+ with uname -r and ensure system stability.📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages
- General protection fault errors in dmesg or system logs
- Unexpected system crashes
Network Indicators:
- Unusual IPv6 multicast routing configuration changes
SIEM Query:
source="kernel" AND ("general protection fault" OR "inet_csk_listen_stop" OR "ip6_mroute")🔗 References
- http://packetstormsecurity.com/files/154059/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=99253eb750fda6a644d5188fb26c43bad8d5a745
- https://github.com/torvalds/linux/commit/99253eb750fda6a644d5188fb26c43bad8d5a745
- https://lists.debian.org/debian-lts-announce/2019/08/msg00016.html
- https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html
- https://lists.openwall.net/netdev/2017/12/04/40
- https://pulsesecurity.co.nz/advisories/linux-kernel-4.9-inetcsklistenstop-gpf
- https://salsa.debian.org/kernel-team/linux/commit/baefcdc2f29923e7325ce4e1a72c3ff0a9800f32
- https://seclists.org/bugtraq/2019/Aug/26
- https://support.f5.com/csp/article/K41582535
- https://support.f5.com/csp/article/K41582535?utm_source=f5support&%3Butm_medium=RSS
- https://usn.ubuntu.com/4145-1/
- https://www.debian.org/security/2019/dsa-4497
- http://packetstormsecurity.com/files/154059/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=99253eb750fda6a644d5188fb26c43bad8d5a745
- https://github.com/torvalds/linux/commit/99253eb750fda6a644d5188fb26c43bad8d5a745
- https://lists.debian.org/debian-lts-announce/2019/08/msg00016.html
- https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html
- https://lists.openwall.net/netdev/2017/12/04/40
- https://pulsesecurity.co.nz/advisories/linux-kernel-4.9-inetcsklistenstop-gpf
- https://salsa.debian.org/kernel-team/linux/commit/baefcdc2f29923e7325ce4e1a72c3ff0a9800f32
- https://seclists.org/bugtraq/2019/Aug/26
- https://support.f5.com/csp/article/K41582535
- https://support.f5.com/csp/article/K41582535?utm_source=f5support&%3Butm_medium=RSS
- https://usn.ubuntu.com/4145-1/
- https://www.debian.org/security/2019/dsa-4497
