VYPR
← All advisories
High severity7.0NVD Advisory· Published Oct 5, 2017· Updated May 13, 2026

CVE-2017-1000112

CVE-2017-1000112

Description

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A race condition in the Linux kernel's UFO handling can switch the packet append path, leading to memory corruption and potential privilege escalation.

Vulnerability

A memory corruption vulnerability exists in the Linux kernel's IPv4 and IPv6 networking code, specifically in the ip_ufo_append_data() function. When building a UFO (UDP Fragmentation Offload) packet with the MSG_MORE flag set, the function is called to append data across multiple send() calls. A race condition can cause the append path to be erroneously switched from UFO to non-UFO between two send() calls [1]. If the UFO packet length exceeds the MTU, the copy = maxfraglen - skb->len calculation becomes negative on the non-UFO path, triggering a new SKB allocation. This leads to a negative fraggap value (skb_prev->len - maxfraglen), which in turn makes copy = datalen - transhdrlen - fraggap negative, causing skb_copy_and_csum_bits() to write out-of-bounds [1]. The bug was introduced in commit e89e9cf539a2 (“[IPv4/IPv6]: UFO Scatter-gather approach”) on October 18, 2005 [1]. Affected versions include the Linux kernel before the fixes released in Red Hat Enterprise Linux 6 and 7 [1][2].

Exploitation

An attacker must have the ability to send network packets and, if unprivileged user namespaces are available, can potentially trigger this race condition to gain root privileges [1]. The attacker would need to send UFO packets with the MSG_MORE flag set across multiple send() calls, exploiting the timing window where the path switches from UFO to non-UFO. The vulnerability is reachable without requiring a raw socket or CAP_NET_RAW capability, making it more accessible [1].

Impact

Successful exploitation results in memory corruption, which can be leveraged to execute arbitrary code with kernel privileges. The attacker can gain root privileges on the system if unprivileged user namespaces are available [1]. This is rated as Important severity with a CVSS v3 base score of 7.0.

Mitigation

Red Hat has released security updates to address this vulnerability. For Red Hat Enterprise Linux 6, the fix is included in the kernel package as per advisory RHSA-2017:3200 [1]. For Red Hat Enterprise Linux 7, the fix is in kernel-3.10.0-693.5.2.el7 as per advisory RHSA-2017:2930 [2]. Later updates (RHSA-2019:1931 and RHSA-2019:4159) also contain the fix [3][4]. Users should apply the updated kernel packages and reboot their systems. No workaround is documented; patching is the recommended mitigation.

References
  1. https://access.redhat.com/errata/RHSA-2017:3200
  2. https://access.redhat.com/errata/RHSA-2017:2930
  3. https://access.redhat.com/errata/RHSA-2019:4159
  4. https://access.redhat.com/errata/RHSA-2019:1931

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

150

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

13

News mentions

0

No linked articles in our index yet.