CVE-2017-1000112

high

Published 2017-10-05 · Modified 2026-05-13

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

7.0

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

8.0

Description

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005.

Predictions

Exploit likelihood

100%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-45147 local linux verified

Metasploit · 2018-08-03

Linux Kernel - UDP Fragmentation Offset 'UFO' Privilege Escalation (Metasploit)

Source code queued for fetch — refresh in a moment.

EDB-47169 local linux

bcoles · 2018-12-29

Linux Kernel < 4.4.0/ < 4.8.0 (Ubuntu 14.04/16.04 / Linux Mint 17/18 / Zorin) - Local Privilege Escalation (KASLR / SMEP)

Source code queued for fetch — refresh in a moment.

EDB-43418 local linux verified

Andrey Konovalov · 2017-08-13

Linux Kernel < 4.4.0-83 / < 4.8.0-58 (Ubuntu 14.04/16.04) - Local Privilege Escalation (KASLR / SMEP)

Source code queued for fetch — refresh in a moment.

Metasploit modules

exploit_linux/local/ufo_privilege_escalation rank 400

Linux Kernel UDP Fragmentation Offset (UFO) Privilege Escalation

Source fetch failed: fetch_error — view the original via the link above.

OS impact

Linux kernel Affected 1 release

Version	Status	Fixed in
—	Affected	`3.10.108`

SUSE Affected 1 release

Version	Status	Fixed in
—	Affected	—

Arch Fixed 1 release

Version	Status	Fixed in
—	Fixed	`4.13-1`

Debian Fixed 5 releases

Version	Status	Fixed in
trixie	Fixed	`4.12.6-1`
sid	Fixed	`4.12.6-1`
forky	Fixed	`4.12.6-1`
bullseye	Fixed	`4.12.6-1`
bookworm	Fixed	`4.12.6-1`

References

CWEs

CWE-362

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.