The xfrm_state_netlink function in net/xfrm/xfrm_user.c in the Linux kernel before 3.5.7 does not properly handle error conditions in dump_one_state function calls, which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Linux_kernel | Linux | 3.5.2 | 3.5.2 |
| Linux_kernel | Linux | * | 3.5.6 |
| Linux_kernel | Linux | 3.5.5 | 3.5.5 |
| Linux_kernel | Linux | 3.5.3 | 3.5.3 |
| Linux_kernel | Linux | 3.5.4 | 3.5.4 |
| Linux_kernel | Linux | 3.5.1 | 3.5.1 |