=Start=

漏洞概述：

漏洞编号：CVE-2017-6074
漏洞发现者：Andrey Konovalov
漏洞危害：通过非特权进程获得内核代码执行进而提升权限

影响范围：

Linux内核版本>2.6.18(2006年9月)。但DCCP(数据报拥塞控制协议)最早是在05年10月的Linux内核版本2.6.14中支持的。目前该漏洞于2017年2月17日修复。

修复方案：

临时规避：

Red Hat’s bug tracker provides some mitigation tactics without updating the kernel and rebooting your box.

Recent versions of Selinux policy can mitigate this exploit. The steps below will work with SElinux enabled or disabled.

As the DCCP module will be auto loaded when required, its use can be disabled
by preventing the module from loading with the following instructions.

# echo "install dccp /bin/true" >> /etc/modprobe.d/disable-dccp.conf

The system will need to be restarted if the dccp modules are loaded. In most circumstances the dccp kernel modules will be unable to be unloaded while any network interfaces are active and the protocol is in use.

If you need further assistance, see this KCS article ( https://access.redhat.com/solutions/41278 ) or contact Red Hat Global Support Services.

长期解决：

升级内核至安全版本

PoC/Exp：

https://github.com/xairy/kernel-exploits/tree/master/CVE-2017-6074

参考来源：

Use-after-free in the IPv6 implementation of the DCCP protocol in the Linux kernel – CVE-2017-6074
https://access.redhat.com/security/vulnerabilities/2934281
https://access.redhat.com/sites/default/files/cve-2017-6074-2.sh

Linux kernel: CVE-2017-6074 – local privilege escalation in DCCP
https://ma.ttias.be/linux-kernel-cve-2017-6074-local-privilege-escalation-dccp/

【更新PoC】潜伏11年的Linux内核提权漏洞曝光
http://www.freebuf.com/news/127620.html
http://securityaffairs.co/wordpress/56566/hacking/cve-2017-6074-linux-flaw.html
http://thehackernews.com/2017/02/linux-kernel-local-root.html
https://github.com/xairy/kernel-exploits/tree/master/CVE-2017-6074

http://www.openwall.com/lists/oss-security/2017/02/26/2

【漏洞预警】雪藏11年：Linux kernel DCCP double-free 权限提升漏洞（CVE-2017-6074）
http://bobao.360.cn/learning/detail/3529.html
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-6074
https://www.suse.com/support/kb/doc?id=7018645

CVE-2017-6074：Linux内核中存在11年的特权提升漏洞（更新POC）
http://www.mottoin.com/96940.html

Linux kernel: CVE-2017-6074: DCCP double-free vulnerability (local root)
https://news.ycombinator.com/item?id=13705833
https://www.reddit.com/r/netsec/comments/5vjpgj/linux_kernel_cve20176074_dccp_doublefree/

=END=