CVE-2017-6951 in Linux
Summary
by MITRE
The keyring_search_aux function in security/keys/keyring.c in the Linux kernel through 3.14.79 allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a request_key system call for the "dead" type.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 03/17/2017
The vulnerability identified as CVE-2017-6951 resides within the Linux kernel's key management subsystem, specifically in the keyring_search_aux function located in security/keys/keyring.c. This flaw affects kernel versions through 3.14.79 and represents a critical denial of service vulnerability that can be exploited by local attackers. The vulnerability manifests when a request_key system call is made for the "dead" type, which triggers an improper handling of keyring search operations that leads to system instability.
The technical root cause of this vulnerability stems from a NULL pointer dereference condition within the keyring_search_aux function. When processing a request_key system call with the "dead" type, the function fails to properly validate keyring references before attempting to access them, resulting in a kernel NULL pointer dereference that generates an OOPS message and ultimately crashes the system. This behavior violates fundamental kernel safety principles and represents a classic example of improper input validation and resource management. The vulnerability aligns with CWE-476 which specifically addresses NULL pointer dereference conditions in software systems.
The operational impact of this vulnerability extends beyond simple system crashes as it provides local attackers with a reliable method to induce denial of service conditions within kernel space. Since the vulnerability requires only local user privileges to exploit, it presents a significant risk in multi-user environments where untrusted users could potentially disrupt system operations. The OOPS condition generated by this flaw typically results in immediate system instability and requires manual intervention to restore normal operations, making it particularly dangerous in production environments where uptime is critical.
From a threat modeling perspective, this vulnerability fits within the ATT&CK framework under the T1499.004 technique for Network Denial of Service, though it operates at the kernel level rather than network protocols. The local privilege requirement means that attackers do not need elevated privileges to exploit the vulnerability, which significantly increases the attack surface. This weakness demonstrates poor defensive programming practices in kernel space where proper error handling and validation mechanisms should have been implemented to prevent such scenarios. Organizations should consider implementing kernel hardening measures and monitoring for unusual OOPS conditions that could indicate exploitation attempts.
Mitigation strategies for CVE-2017-6951 primarily involve upgrading to kernel versions that contain the appropriate patches, which were released as part of the 4.10 kernel series and subsequent stable releases. System administrators should also implement monitoring solutions that can detect kernel OOPS conditions and NULL pointer dereference patterns, as these may indicate exploitation attempts. Additionally, kernel lockdown mechanisms and access controls should be implemented to limit local user privileges where possible. The vulnerability underscores the importance of proper kernel validation and input sanitization, particularly in security-critical subsystems where improper error handling can lead to complete system compromise.