CVE-2017-6347

Name	CVE-2017-6347
Description	The ip_cmsg_recv_checksum function in net/ipv4/ip_sockglue.c in the Linux kernel before 4.10.1 has incorrect expectations about skb data layout, which allows local users to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted system calls, as demonstrated by use of the MSG_MORE flag in conjunction with loopback UDP transmission.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
linux (PTS)	buster	4.19.249-2	fixed
	buster (security)	4.19.282-1	fixed
	bullseye	5.10.178-3	fixed
	bullseye (security)	5.10.179-1	fixed
	bookworm, sid	6.1.27-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
linux	source	wheezy	(not affected)
linux	source	jessie	(not affected)
linux	source	(unstable)	4.9.13-1

Notes

[jessie] - linux <not-affected> (Vulnerable code introduced in 4.0)
[wheezy] - linux <not-affected> (Vulnerable code introduced in 4.0)
Fixed by: https://git.kernel.org/linus/ca4ef4574f1ee5252e2cd365f8f5d5bafd048f32