Launchpad.net

CVE 2017-7184

The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, which allows local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-image-* package 4.8.0.41.52.

Related bugs and status

CVE-2017-7184 (Candidate) is related to these bugs:

Bug #1638996: apparmor's raw_data file in securityfs is sometimes truncated

		In	Importance	Status
1638996	apparmor's raw_data file in securityfs is sometimes truncated	linux (Ubuntu)	Undecided	Fix Released
1638996	apparmor's raw_data file in securityfs is sometimes truncated	linux (Ubuntu Yakkety)	Undecided	Fix Released
1638996	apparmor's raw_data file in securityfs is sometimes truncated	linux (Ubuntu Xenial)	Undecided	Fix Released

Bug #1645187: 4.4.0-47-generic dm_snapshot random deadlock

Summary				In	Importance	Status
	1645187	4.4.0-47-generic dm_snapshot random deadlock		linux (Ubuntu)	High	Triaged
	1645187	4.4.0-47-generic dm_snapshot random deadlock		linux (Ubuntu Xenial)	High	Triaged

Bug #1648143: tor in lxd: apparmor="DENIED" operation="change_onexec" namespace="root//CONTAINERNAME_<var-lib-lxd>" profile="unconfined" name="system_tor"

		In	Importance	Status
1648143	tor in lxd: apparmor="DENIED" operation="change_onexec" namespace="root//CONTAINERNAME_<var-lib-lxd>" profile="unconfined" name="system_tor"	apparmor (Ubuntu)	Undecided	Invalid
1648143	tor in lxd: apparmor="DENIED" operation="change_onexec" namespace="root//CONTAINERNAME_<var-lib-lxd>" profile="unconfined" name="system_tor"	tor (Ubuntu)	Undecided	Invalid
1648143	tor in lxd: apparmor="DENIED" operation="change_onexec" namespace="root//CONTAINERNAME_<var-lib-lxd>" profile="unconfined" name="system_tor"	linux (Ubuntu)	Undecided	Fix Released
1648143	tor in lxd: apparmor="DENIED" operation="change_onexec" namespace="root//CONTAINERNAME_<var-lib-lxd>" profile="unconfined" name="system_tor"	linux (Ubuntu Yakkety)	Undecided	Fix Released
1648143	tor in lxd: apparmor="DENIED" operation="change_onexec" namespace="root//CONTAINERNAME_<var-lib-lxd>" profile="unconfined" name="system_tor"	tor (Ubuntu Yakkety)	Undecided	Invalid
1648143	tor in lxd: apparmor="DENIED" operation="change_onexec" namespace="root//CONTAINERNAME_<var-lib-lxd>" profile="unconfined" name="system_tor"	linux (Ubuntu Xenial)	Undecided	Fix Released
1648143	tor in lxd: apparmor="DENIED" operation="change_onexec" namespace="root//CONTAINERNAME_<var-lib-lxd>" profile="unconfined" name="system_tor"	tor (Ubuntu Xenial)	Undecided	Invalid

Bug #1656121: unexpected errno=13 and disconnected path when trying to open /proc/1/ns/mnt from a unshared mount namespace

		In	Importance	Status
1656121	unexpected errno=13 and disconnected path when trying to open /proc/1/ns/mnt from a unshared mount namespace	AppArmor	Undecided	Confirmed
1656121	unexpected errno=13 and disconnected path when trying to open /proc/1/ns/mnt from a unshared mount namespace	linux (Ubuntu)	Undecided	Incomplete
1656121	unexpected errno=13 and disconnected path when trying to open /proc/1/ns/mnt from a unshared mount namespace	linux (Ubuntu Yakkety)	Undecided	Fix Released
1656121	unexpected errno=13 and disconnected path when trying to open /proc/1/ns/mnt from a unshared mount namespace	linux (Ubuntu Xenial)	Undecided	Fix Released

Bug #1658219: flock not mediated by 'k'

		In	Importance	Status
1658219	flock not mediated by 'k'	AppArmor	Undecided	In Progress
1658219	flock not mediated by 'k'	linux (Ubuntu)	Undecided	Fix Released
1658219	flock not mediated by 'k'	linux (Ubuntu Yakkety)	Undecided	Won't Fix
1658219	flock not mediated by 'k'	linux (Ubuntu Xenial)	Undecided	Triaged

Bug #1660833: apparmor reference count bug in label_merge_insert()

		In	Importance	Status
1660833	apparmor reference count bug in label_merge_insert()	linux (Ubuntu)	Undecided	Fix Released
1660833	apparmor reference count bug in label_merge_insert()	linux (Ubuntu Zesty)	Undecided	Fix Released
1660833	apparmor reference count bug in label_merge_insert()	linux (Ubuntu Yakkety)	Undecided	Fix Released
1660833	apparmor reference count bug in label_merge_insert()	linux (Ubuntu Xenial)	Undecided	Fix Released

Bug #1660834: apparmor label leak when new label is unused

		In	Importance	Status
1660834	apparmor label leak when new label is unused	linux (Ubuntu)	Undecided	Fix Released
1660834	apparmor label leak when new label is unused	linux (Ubuntu Zesty)	Undecided	Fix Released
1660834	apparmor label leak when new label is unused	linux (Ubuntu Xenial)	Undecided	Fix Released
1660834	apparmor label leak when new label is unused	linux (Ubuntu Yakkety)	Undecided	Fix Released

Bug #1660836: apparmor auditing denied access of special apparmor .null fi\ le

		In	Importance	Status
1660836	apparmor auditing denied access of special apparmor .null fi\ le	linux (Ubuntu)	Undecided	Fix Released
1660836	apparmor auditing denied access of special apparmor .null fi\ le	linux (Ubuntu Zesty)	Undecided	Fix Released
1660836	apparmor auditing denied access of special apparmor .null fi\ le	linux (Ubuntu Xenial)	Undecided	Fix Released
1660836	apparmor auditing denied access of special apparmor .null fi\ le	linux (Ubuntu Yakkety)	Undecided	Fix Released

Bug #1660840: apparmor oops in bind_mnt when dev_path lookup fails

		In	Importance	Status
1660840	apparmor oops in bind_mnt when dev_path lookup fails	linux (Ubuntu)	Undecided	Fix Released
1660840	apparmor oops in bind_mnt when dev_path lookup fails	linux (Ubuntu Xenial)	Undecided	Fix Released
1660840	apparmor oops in bind_mnt when dev_path lookup fails	linux (Ubuntu Zesty)	Undecided	Fix Released
1660840	apparmor oops in bind_mnt when dev_path lookup fails	linux (Ubuntu Yakkety)	Undecided	Fix Released

Bug #1660845: apparmor reference count leak when securityfs_setup_d_inode\ () fails

		In	Importance	Status
1660845	apparmor reference count leak when securityfs_setup_d_inode\ () fails	linux (Ubuntu)	Undecided	Fix Released
1660845	apparmor reference count leak when securityfs_setup_d_inode\ () fails	linux (Ubuntu Yakkety)	Undecided	Won't Fix
1660845	apparmor reference count leak when securityfs_setup_d_inode\ () fails	linux (Ubuntu Zesty)	Undecided	Fix Released
1660845	apparmor reference count leak when securityfs_setup_d_inode\ () fails	linux (Ubuntu Xenial)	Undecided	Triaged

Bug #1660846: apparmor leaking securityfs pin count

		In	Importance	Status
1660846	apparmor leaking securityfs pin count	linux (Ubuntu)	Undecided	Fix Released
1660846	apparmor leaking securityfs pin count	linux (Ubuntu Xenial)	Undecided	Triaged
1660846	apparmor leaking securityfs pin count	linux (Ubuntu Zesty)	Undecided	Fix Released
1660846	apparmor leaking securityfs pin count	linux (Ubuntu Yakkety)	Undecided	Won't Fix

Bug #1660849: apparmor refcount leak of profile namespace when removing profiles

		In	Importance	Status
1660849	apparmor refcount leak of profile namespace when removing profiles	linux (Ubuntu)	Undecided	Fix Released
1660849	apparmor refcount leak of profile namespace when removing profiles	linux (Ubuntu Zesty)	Undecided	Fix Released
1660849	apparmor refcount leak of profile namespace when removing profiles	linux (Ubuntu Xenial)	Undecided	Fix Released
1660849	apparmor refcount leak of profile namespace when removing profiles	linux (Ubuntu Yakkety)	Undecided	Fix Released

Bug #1661030: regession tests failing after stackprofile test is run

		In	Importance	Status
1661030	regession tests failing after stackprofile test is run	apparmor (Ubuntu)	High	Fix Released
1661030	regession tests failing after stackprofile test is run	apparmor (Ubuntu Zesty)	High	Fix Released
1661030	regession tests failing after stackprofile test is run	apparmor (Ubuntu Xenial)	Undecided	Fix Committed
1661030	regession tests failing after stackprofile test is run	apparmor (Ubuntu Yakkety)	Undecided	Fix Committed
1661030	regession tests failing after stackprofile test is run	linux (Ubuntu)	Undecided	Incomplete
1661030	regession tests failing after stackprofile test is run	linux (Ubuntu Xenial)	Undecided	Fix Released
1661030	regession tests failing after stackprofile test is run	linux (Ubuntu Yakkety)	Undecided	Fix Released
1661030	regession tests failing after stackprofile test is run	linux (Ubuntu Zesty)	Undecided	Incomplete

Bug #1679252: Cloud images for non-Intel architectures are configured with security repos that don't work

Summary				In	Importance	Status
	1679252	Cloud images for non-Intel architectures are configured with security repos that don't work		livecd-rootfs (Ubuntu)	Undecided	Fix Released
	1679252	Cloud images for non-Intel architectures are configured with security repos that don't work		livecd-rootfs (Ubuntu Xenial)	Undecided	Fix Released

See the

CVE page on Mitre.org for more details.

Launchpad.net

CVE 2017-7184

Related bugs and status

Related bugs

References