CVE-2017-15129

Name: CVE-2017-15129
Creator: NVD / NIST
Published: 2018-01-09T19:29:00.217+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 4.7/10EPSS 0.36%

Last modified Jun 17, 2026

CVE-2017-15129 is a medium-severity vulnerability rated 4.7/10 on the CVSS scale. A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. EPSS estimates a 0.36% chance of exploitation in the next 30 days.

Description

A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely.

Metrics

CVSS 3.1

4.7/10

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Probability

0.36%

27.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions	Update
Linux	Linux Kernel	>= 4.0, < 4.14.11	—
Linux	Linux Kernel	4.15	Rc1
Fedoraproject	Fedora	27	—
Canonical	Ubuntu Linux	14.04	—
Canonical	Ubuntu Linux	16.04	—
Canonical	Ubuntu Linux	17.10	—
Redhat	Enterprise Linux	7.0	—
Redhat	Enterprise Linux Compute Node Eus	7.4	—
Redhat	Enterprise Linux Desktop	7.0	—
Redhat	Enterprise Linux Eus	7.4	—
Redhat	Enterprise Linux Eus	7.6	—
Redhat	Enterprise Linux Eus	7.7	—
Redhat	Enterprise Linux For Ibm Z Systems	7.0	—
Redhat	Enterprise Linux For Ibm Z Systems Eus	7.4	—
Redhat	Enterprise Linux For Power Big Endian	7.0	—
Redhat	Enterprise Linux For Power Big Endian Eus	7.4	—
Redhat	Enterprise Linux For Power Little Endian Eus	7.4	—
Redhat	Enterprise Linux For Real Time	7.0	—
Redhat	Enterprise Linux For Real Time For Nfv	7	—
Redhat	Enterprise Linux For Scientific Computing	7.0	—
Redhat	Enterprise Linux Server	7.0	—
Redhat	Enterprise Linux Server Aus	7.4	—
Redhat	Enterprise Linux Server Tus	7.4	—
Redhat	Enterprise Linux Server Tus	7.6	—
Redhat	Enterprise Linux Server Tus	7.7	—
Redhat	Enterprise Linux Server Update Services For Sap Solutions	7.4	—
Redhat	Enterprise Linux Workstation	7.0	—

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=21b5944350052d2583e82dd59b19a9ba94a007f0Patch
http://seclists.org/oss-sec/2018/q1/7Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/102485Broken Link
https://access.redhat.com/errata/RHSA-2018:0654Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0676Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1062Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1946Third Party Advisory
https://access.redhat.com/security/cve/CVE-2017-15129Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1531174Issue Tracking, Patch, Third Party Advisory
https://github.com/torvalds/linux/commit/21b5944350052d2583e82dd59b19a9ba94a007f0Patch
https://marc.info/?l=linux-netdev&m=151370451121029&w=2Mailing List, Patch, Third Party Advisory
https://marc.info/?t=151370468900001&r=1&w=2Mailing List, Third Party Advisory
https://usn.ubuntu.com/3617-1/Third Party Advisory
https://usn.ubuntu.com/3617-2/Third Party Advisory
https://usn.ubuntu.com/3617-3/Third Party Advisory
https://usn.ubuntu.com/3619-1/Third Party Advisory
https://usn.ubuntu.com/3619-2/Third Party Advisory
https://usn.ubuntu.com/3632-1/Third Party Advisory
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.11Release Notes
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=21b5944350052d2583e82dd59b19a9ba94a007f0Patch
http://seclists.org/oss-sec/2018/q1/7Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/102485Broken Link
https://access.redhat.com/errata/RHSA-2018:0654Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0676Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1062Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1946Third Party Advisory
https://access.redhat.com/security/cve/CVE-2017-15129Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1531174Issue Tracking, Patch, Third Party Advisory
https://github.com/torvalds/linux/commit/21b5944350052d2583e82dd59b19a9ba94a007f0Patch
https://marc.info/?l=linux-netdev&m=151370451121029&w=2Mailing List, Patch, Third Party Advisory
https://marc.info/?t=151370468900001&r=1&w=2Mailing List, Third Party Advisory
https://usn.ubuntu.com/3617-1/Third Party Advisory
https://usn.ubuntu.com/3617-2/Third Party Advisory
https://usn.ubuntu.com/3617-3/Third Party Advisory
https://usn.ubuntu.com/3619-1/Third Party Advisory
https://usn.ubuntu.com/3619-2/Third Party Advisory
https://usn.ubuntu.com/3632-1/Third Party Advisory
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.11Release Notes

Timeline

Published: Jan 9, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-15129?

How severe is CVE-2017-15129?

CVE-2017-15129 has a CVSS score of 4.7/10 (MEDIUM severity). The EPSS model estimates a 0.36% probability of exploitation in the next 30 days.

How do I fix CVE-2017-15129?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-15129?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST