$ cve CVE-2017-1000112 JSON

CVE-2017-1000112 EXPLOIT

7.0

HIGH · CVSS 3.1 · EPSS 20.8% (pctl 97)

Patch early

A public exploit exists.

Description

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005.

Scoring

CVSS	7.0 (HIGH, v3.1)
Vector	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS	20.8% — more likely to be exploited than 97% of all CVEs
Weakness	CWE-362
On CISA KEV	no
Public exploit	yes
Published	2017-10-05
Last modified	2026-06-17

Affected (1)

Vendor	Product
linux	linux kernel

Public exploits

Source	Title	Date
exploit-db	Linux Kernel < 4.4.0/ < 4.8.0 (Ubuntu 14.04/16.04 / Linux Mint 17/18 / Zorin) - Local Privilege Escalation (KASLR / SMEP)	2018-12-29
exploit-db	Linux Kernel - UDP Fragmentation Offset 'UFO' Privilege Escalation (Metasploit)	2018-08-03
exploit-db	Linux Kernel < 4.4.0-83 / < 4.8.0-58 (Ubuntu 14.04/16.04) - Local Privilege Escalation (KASLR / SMEP)	2017-08-13

References

→ the Explorer · watch your stack · NVD