SB2017022426 - Red Hat Enterprise Linux 5 update for kernel 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017022426

SB2017022426 - Red Hat Enterprise Linux 5 update for kernel

Published: February 24, 2017 Updated: April 24, 2025

Security Bulletin ID SB2017022426
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2017-2634)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

It was found that the Linux kernel's Datagram Congestion Control Protocol (DCCP) implementation before 2.6.22.17 used the IPv4-only inet_sk_rebuild_header() function for both IPv4 and IPv6 DCCP connections, which could result in memory corruptions. A remote attacker could use this flaw to crash the system.


2) Resource management error (CVE-ID: CVE-2017-6074)

The vulnerability allows a local user to cause kernel panic.

The vulnerability exists due to invalid free in the dccp_rcv_state_process() function in net/dccp/input.c file in the Linux kernel through 4.9.11 when processing DCCP_PKT_REQUEST packet data structures in the LISTEN state. A local user can use userspace application to make an IPV6_RECVPKTINFO setsockopt system call and cause kernel panic.

Successful exploitation of this vulnerability may result in denial of service condition.



Remediation

Install update from vendor's website.

References