net/sctp/socket.c in the Linux kernel through 4.10.1 does not properly restrict association peel-off operations during certain wait states, which allows local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986.
[
{
"id": "CVE-2017-6353-1561f19e",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260955618778325445365822697959854224006",
"51761880580633615855676771858493517188",
"231460293136219045405356695904635145032",
"324868241582970331347777493119933058162",
"49733608178454676250901702367625895730",
"96734808398459813429659667184105609204",
"306617207574490141611904186197522713314",
"89223266476589409415938526122269317571"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@dfcb9f4f99f1e9a49e43398a7bfbf56927544af1",
"signature_type": "Line",
"target": {
"file": "net/sctp/socket.c"
}
},
{
"id": "CVE-2017-6353-a04f0345",
"signature_version": "v1",
"digest": {
"function_hash": "230763695025011313446083455989626585820",
"length": 942.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@dfcb9f4f99f1e9a49e43398a7bfbf56927544af1",
"signature_type": "Function",
"target": {
"file": "net/sctp/socket.c",
"function": "sctp_wait_for_sndbuf"
}
},
{
"id": "CVE-2017-6353-c944e8a5",
"signature_version": "v1",
"digest": {
"function_hash": "15067328265758164331748714983835980686",
"length": 581.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@dfcb9f4f99f1e9a49e43398a7bfbf56927544af1",
"signature_type": "Function",
"target": {
"file": "net/sctp/socket.c",
"function": "sctp_do_peeloff"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-6353.json"
[
{
"id": "CVE-2017-6353-300af6f8",
"signature_version": "v1",
"digest": {
"function_hash": "230763695025011313446083455989626585820",
"length": 942.0
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/dfcb9f4f99f1e9a49e43398a7bfbf56927544af1",
"signature_type": "Function",
"target": {
"file": "net/sctp/socket.c",
"function": "sctp_wait_for_sndbuf"
}
},
{
"id": "CVE-2017-6353-4ad80918",
"signature_version": "v1",
"digest": {
"function_hash": "15067328265758164331748714983835980686",
"length": 581.0
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/dfcb9f4f99f1e9a49e43398a7bfbf56927544af1",
"signature_type": "Function",
"target": {
"file": "net/sctp/socket.c",
"function": "sctp_do_peeloff"
}
},
{
"id": "CVE-2017-6353-96d9613c",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260955618778325445365822697959854224006",
"51761880580633615855676771858493517188",
"231460293136219045405356695904635145032",
"324868241582970331347777493119933058162",
"49733608178454676250901702367625895730",
"96734808398459813429659667184105609204",
"306617207574490141611904186197522713314",
"89223266476589409415938526122269317571"
]
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/dfcb9f4f99f1e9a49e43398a7bfbf56927544af1",
"signature_type": "Line",
"target": {
"file": "net/sctp/socket.c"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-6353.json"