CVE-2017-6353

net/sctp/socket.c in the Linux kernel through 4.10.1 does not properly restrict association peel-off operations during certain wait states, which allows local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986.

• CWE-415

• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dfcb9f4f99f1e9a49e43398a7bfbf56927544af1Patch, Third Party Advisory
• http://www.debian.org/security/2017/dsa-3804
• http://www.openwall.com/lists/oss-security/2017/02/27/2Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/96473
• https://github.com/torvalds/linux/commit/dfcb9f4f99f1e9a49e43398a7bfbf56927544af1Patch, Third Party Advisory
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dfcb9f4f99f1e9a49e43398a7bfbf56927544af1Patch, Third Party Advisory
• http://www.debian.org/security/2017/dsa-3804
• http://www.openwall.com/lists/oss-security/2017/02/27/2Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/96473
• https://github.com/torvalds/linux/commit/dfcb9f4f99f1e9a49e43398a7bfbf56927544af1Patch, Third Party Advisory

Published

Mar 1, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-6346Race condition in net/packet/af_packet.c in the Linux kernel…7
• CVE-2017-6347The ip_cmsg_recv_checksum function in net/ipv4/ip_sockglue.c…7.8
• CVE-2017-6348The hashbin_delete function in net/irda/irqueue.c in the Lin…
• CVE-2017-6349An integer overflow at a u_read_undo memory allocation site …
• CVE-2017-6350An integer overflow at an unserialize_uep memory allocation …
• CVE-2017-6351The WePresent WiPG-1500 device with firmware 1.0.3.7 has a m…
• CVE-2017-6355Integer overflow in the vrend_create_shader function in vren…
• CVE-2017-6356Palo Alto Networks Terminal Services (aka TS) Agent 6.0, 7.0…5.3
• CVE-2017-6359QNAP QTS before 4.2.4 Build 20170313 allows attackers to gai…
• CVE-2017-6360QNAP QTS before 4.2.4 Build 20170313 allows attackers to gai…
• CVE-2017-6361QNAP QTS before 4.2.4 Build 20170313 allows attackers to exe…
• CVE-2017-6362Double free vulnerability in the gdImagePngPtr function in l…