CVE-2017-11176
The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close...
- Published
- Jul 11, 2017
- Updated
- Aug 5, 2024
- Assigning CNA
- mitre
- Evidence observed
- Oct 2, 2018
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLow · next 30 days
- Percentile
- 89.0%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact.
Sources
9- CVE-2017-11176Exploit
Proof-of-concept exploit for CVE-2017-11176, a use-after-free in Linux kernel's mq_notify function, enabling local privilege escalation via Netlink socket manipulation.
- cve-2017-11176Exploit
My first try to code my own LPE exploit.
Proof-of-concept exploit for CVE-2017-11176, a local privilege escalation vulnerability in the Linux kernel. Demonstrates exploitation of a use-after-free bug in the netlink subsystem.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.