Use-after-free in the IPv6 implementation of the DCCP protocol in the Linux kernel - CVE-2017-6074

Red Hat Product Security has been made aware of a vulnerability affecting the Linux kernel's DCCP protocol IPV6 implementation.  The vulnerability has been assigned CVE-2017-6074.  This issue was publicly disclosed on 20-Feb-2017 and has been rated as Important.

Background Information

DCCP is a layer 4 (transport) protocol intended to allow programmers to control network congestion settings on the application layer.  This protocol is routable across the internet as it uses IP as its layer 3 (network) protocol.  Because of this, the protocol was designed to work over both IPV4 and IPV6 based systems.  This exploit explicitly uses IPV6 based DCCP connections.

DCCP uses an internal state machine to keep track of connections.  In this circumstance the DCCP state machine mishandles DCCP_PKT_REQUEST data structures while the socket is in the LISTEN state.  This allows a local user who can control both client and server on the same networked node to provide a "Use After Free" situation.  When a connection is established a data structure called skbuff is created per connection.  At the tail of skbuff is another struct called skb_shared_info, which in turn contains a ubuf_info struct.  This struct contains a function pointer that is to be called when the skb is to be cleaned up.  The error condition is that this ubuf_info struct's callback function was being called after the memory for the skbuff had been freed.  This allows an attacker to create a situation in which that memory can be overwritten with malicious instructions, abusing the function pointer value in the time between free and secondary misuse.

The attack requires both server and client running on the same system to ensure reference to the sk_shared_info struct is able to be referenced after it has been freed.

Acknowledgments

Red Hat would like to thank Andrey Konovalov for reporting and assisting with this issue.

Red Hat Product Security has rated this update as having a security impact of Important.

Impacted Products

The following Red Hat product versions are impacted:

• Red Hat Enterprise Linux 5
• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Red Hat Enterprise MRG 2
• Red Hat Openshift Online v2
• Red Hat Virtualization (RHEV-H/RHV-H)
• RHEL Atomic Host 

Attack Description and Impact

This flaw allows an attacker with an account on the local system to potentially elevate privileges. This class of flaw is commonly referred to as UAF (Use After Free.) Flaws of this nature are generally exploited by exercising a code path that accesses memory via a pointer that no longer references an in use allocation due to an earlier free() operation. In this specific issue, the flaw exists in the DCCP networking code and can be reached by a malicious actor with sufficient access to initiate a DCCP network connection on any local interface. Successful exploitation may result in crashing of the host kernel, potential execution of code in the context of the host kernel or other escalation of privilege by modifying kernel memory structures. An attacker must have access to a local account on the system; this is not a remote attack and requires IPV6 support to be enabled.

Diagnose your vulnerability