CVE-2017-15115

What it actually does

Missing netns validation in sctp_do_peeloff allows a local process to trigger a use-after-free in the SCTP socket layer via crafted system calls, resulting in kernel memory corruption that can produce a crash or additional attacker-controlled impact.

Why it matters to the business

Unprivileged local users on affected Linux systems can crash the kernel, causing denial of service and potential loss of availability for any workloads running on that host; older unpatched kernels remain exposed years after disclosure.

How an attack unfolds

An attacker with local access on a vulnerable kernel invokes a sequence of SCTP system calls that perform a peel-off operation while referencing a socket from an unintended network namespace; the absent namespace check leaves a dangling reference that the kernel later dereferences, producing a use-after-free.

How to fix it

Upgrade the Linux kernel to a version containing commit df80cd9b28b9ebaa284a41df611dbf3a2d05ca74 or later; rebuild and reboot with the patched kernel; where live patching is available apply the vendor's backported fix.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or is newer than the vulnerable range; inspect /proc/version or uname output against the fixed commit hash; run regression tests that exercise SCTP peel-off operations across network namespaces.

Typical attack path

1. Obtain local shell or code execution on the target Linux system
2. Load or exercise SCTP protocol handling if not already present
3. Issue crafted socket, bind, and peel-off system calls that cross network namespaces
4. Trigger the use-after-free to crash the kernel or attempt further corruption

How to detect it

Review kernel logs and crash dumps for SCTP socket or use-after-free oops signatures; audit system-call traces for unusual sequences involving sctp_peeloff or netns manipulation; examine any available eBPF or auditd records of SCTP-related syscalls around the time of a kernel panic.

What your security team should do

• Patch all Linux hosts to a kernel containing the fix commit at the earliest maintenance window
• Restrict unprivileged local access and SCTP socket creation via seccomp or LSM policies until patches are applied
• Monitor kernel crash reports for SCTP-related oopses as an indicator of attempted exploitation