Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that changes socket state may race with safety checks in packet_set_ring. Previously with PACKET_VERSION. This time with PACKET_RESERVE. The solution is similar: lock the socket for the update. This issue may be exploitable, we did not investigate further. As this issue affects PF_PACKET sockets, it requires CAP_NET_RAW in the process namespace. But note that with user namespaces enabled, any process can create a namespace in which it has CAP_NET_RAW. #### Notes Author| Note ---|--- [sbeattie](<https://launchpad.net/~sbeattie>) | fix subject "net-packet: fix race in packet_set_ring on PACKET_RESERVE" [smb](<https://launchpad.net/~smb>) | While working on the embargoed CVE we decided that Precise cannot be exploited due to the missing user namespace support.

Affected Package

OS OS Version Package Name Package Version
ubuntu 14.04 linux 3.13.0-128.177
ubuntu upstream linux 4.13~rc5
ubuntu 16.04 linux 4.4.0-91.114
ubuntu 17.04 linux 4.10.0-32.36
ubuntu upstream linux-armadaxp 4.13~rc5
ubuntu upstream linux-aws 4.13~rc5
ubuntu 16.04 linux-aws 4.4.0-1030.39
ubuntu upstream linux-azure 4.13~rc5
ubuntu upstream linux-euclid 4.13~rc5
ubuntu upstream linux-flo 4.13~rc5
ubuntu upstream linux-gcp 4.13~rc5
ubuntu upstream linux-gke 4.13~rc5
ubuntu 16.04 linux-gke 4.4.0-1026.26
ubuntu upstream linux-goldfish 4.13~rc5
ubuntu 16.04 linux-goldfish any
ubuntu upstream linux-grouper 4.13~rc5
ubuntu upstream linux-hwe 4.13~rc5
ubuntu 16.04 linux-hwe 4.10.0-32.36~16.04.1
ubuntu 18.04 linux-hwe-edge 4.18.0-8.9~18.04.1
ubuntu upstream linux-hwe-edge 4.13~rc5
ubuntu 16.04 linux-hwe-edge 4.10.0-32.36~16.04.1
ubuntu upstream linux-kvm 4.13~rc5
ubuntu upstream linux-linaro-omap 4.13~rc5
ubuntu upstream linux-linaro-shared 4.13~rc5
ubuntu upstream linux-linaro-vexpress 4.13~rc5
ubuntu upstream linux-lts-quantal 4.13~rc5
ubuntu upstream linux-lts-raring 4.13~rc5
ubuntu upstream linux-lts-saucy 4.13~rc5
ubuntu 12.04 linux-lts-trusty 3.13.0-128.177~precise1
ubuntu upstream linux-lts-trusty 4.13~rc5
ubuntu upstream linux-lts-utopic 4.13~rc5
ubuntu 14.04 linux-lts-vivid any
ubuntu upstream linux-lts-vivid 4.13~rc5
ubuntu upstream linux-lts-wily 4.13~rc5
ubuntu 14.04 linux-lts-xenial 4.4.0-91.114~14.04.1
ubuntu upstream linux-lts-xenial 4.13~rc5
ubuntu upstream linux-maguro 4.13~rc5
ubuntu upstream linux-mako 4.13~rc5
ubuntu upstream linux-manta 4.13~rc5
ubuntu upstream linux-oem 4.13~rc5
ubuntu upstream linux-qcm-msm 4.13~rc5
ubuntu upstream linux-raspi2 4.13~rc5
ubuntu 16.04 linux-raspi2 4.4.0-1069.77
ubuntu 17.04 linux-raspi2 4.10.0-1015.18
ubuntu upstream linux-snapdragon 4.13~rc5
ubuntu 16.04 linux-snapdragon 4.4.0-1071.76
ubuntu 17.04 linux-snapdragon 4.4.0-1071.76
ubuntu upstream linux-ti-omap4 4.13~rc5