VOMIT (go/vomit) has received an external vulnerability report for the Linux kernel.
Advisory: CVE-2017-15126
Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2017-15126
CVSS severity score: 9.3/10.0
Description:
A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is related to the handling of fork failure when dealing with event messages. Failure to fork correctly can lead to a situation where a fork event will be removed from an already freed list of events with userfaultfd_ctx_put().
This bug was filed by http://go/vomit
Please contact us at vomit-team@google.com if you need any assistance.
Comment 1 by zsm@google.com
, Feb 7 2018v3.10 v3.14 v3.18 v3.8 don't seem to have support for the userfaultfd syscall. 4.14 has this issue patched with 384632e67e0("userfaultfd: non-cooperative: fix fork use after free") In 4.4, the patch that introduces the support for fork event 893e26e61d04eac974("userfaultfd: non-cooperative: Add fork() event") does not seem to be present.