Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Linux_kernel | Linux | 3.0.34 (including) | 3.2 (excluding) |
| Linux_kernel | Linux | 3.2.20 (including) | 3.2.88 (excluding) |
| Linux_kernel | Linux | 3.4.2 (including) | 3.12.69 (excluding) |
| Linux_kernel | Linux | 3.13 (including) | 3.16.40 (excluding) |
| Linux_kernel | Linux | 3.17 (including) | 3.18.52 (excluding) |
| Linux_kernel | Linux | 3.19 (including) | 4.4.38 (excluding) |
| Linux_kernel | Linux | 4.5 (including) | 4.8.14 (excluding) |