A vulnerability has been found in Linux Kernel up to 4.13-rc1 (Operating System) and classified as problematic. This vulnerability affects an unknown code of the file net/ipv4/route.c. The manipulation with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability. CVE summarizes:

net/ipv4/route.c in the Linux kernel 4.13-rc1 through 4.13-rc6 is too late to check for a NULL fi field when RTM_F_FIB_MATCH is set, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via crafted system calls. NOTE: this does not affect any stable release.

The bug was discovered 08/24/2017. The weakness was presented 08/24/2017 as confirmed git commit (GIT Repository). The advisory is available at git.kernel.org. This vulnerability was named CVE-2017-13686 since 08/24/2017. Local access is required to approach this attack. A single authentication is needed for exploitation. Technical details are known, but there is no available exploit.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.kernel.org.

See VDB-189072 and VDB-241116 for similar entries.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 4.13-rc1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion