On February 22, 2017, security researcher Andrey Konovalov found a vulnerability in the Linux kernel in the Datagram Congestion Control Protocol (DCCP) when using Syzkaller fuzzing. This vulnerability can go undetected for more than 10 years.
The vulnerability dates back to 2005 and affects the main releases of Linux operating systems, including Red Hat, Debian, OpenSUSE, and Ubuntu. It allows an attacker to run code in the kernel from an unprivileged process. It affects all Linux kernels since 2.6.18 (released on September 2006), though it may have been first introduced as early as October 2005 (when 2.6.14 was released) when DCCP support was provided.
See the following for more information about the vulnerability.
Linux kernel DCCP double-free elevation of privilege vulnerability
This vulnerability allows an attacker to gain elevation of privilege by running code in the kernel from an unprivileged process.
Condition and method of exploitation
This vulnerability can be exploited locally to run code.
Linux kernels later than 2.6.18
How to fix or mitigate
We recommend that you follow up the update source information and upgrade to the latest kernel version in a timely manner.
Note: Back up snapshots before the upgrade.
. Debian: https://security-tracker.debian.org/tracker/CVE-2017-6074
. Redhat: https://rhn.redhat.com/errata/RHSA-2017-0295.html
. Ubuntu: http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-6074.html
. SUSE: https://www.suse.com/security/cve/CVE-2017-6074/