CVE-2017-18017 The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory...
CriticalCVSS 9.8
EPSS 52.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 4.11.6-1 | 4.11.6-1 |
| debian/linux(Debian:13) | < 4.11.6-1 | 4.11.6-1 |
| debian/linux(Debian:14) | < 4.11.6-1 | 4.11.6-1 |
| Linux kernel | >= 3.2, < 3.2.99 | 3.2.99 |
| Linux kernel | >= 3.3, < 3.10.108 | 3.10.108 |
| Linux kernel | >= 3.11, < 3.16.54 | 3.16.54 |
| Linux kernel | >= 3.17, < 3.18.60 | 3.18.60 |
| Linux kernel | >= 3.19, < 4.1.43 | 4.1.43 |
| Linux kernel | >= 4.2, < 4.4.76 | 4.4.76 |
| Linux kernel | >= 4.5, < 4.9.36 | 4.9.36 |
| Linux kernel | >= 4.10, < 4.11 | 4.11 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| arista eos | = 4.20.1fx-virtual-router | No fix listed |
| f5 arx | >= 6.2.0, <= 6.4.0 | No fix listed |
| SUSE caas platform | All versions | No fix listed |
| SUSE linux enterprise debuginfo | = 11-sp3 | No fix listed |
| SUSE linux enterprise debuginfo | = 11-sp4 | No fix listed |
| SUSE linux enterprise module for public cloud | = 12 | No fix listed |
| SUSE linux enterprise point of sale | = 11-sp3 | No fix listed |
| SUSE openstack cloud | = 6 | No fix listed |
| openSUSE leap | = 42.3 | No fix listed |
| SUSE linux enterprise desktop | = 12-sp2 | No fix listed |
| SUSE linux enterprise desktop | = 12-sp3 | No fix listed |
| SUSE linux enterprise high availability | = 12-sp2 | No fix listed |
Show 42 more
| Product | Affected versions | Fixed in |
|---|---|---|
| SUSE linux enterprise high availability | = 12-sp3 | No fix listed |
| SUSE linux enterprise high availability extension | = 11-sp4 | No fix listed |
| SUSE linux enterprise live patching | = 12 | No fix listed |
| SUSE linux enterprise live patching | = 12-sp3 | No fix listed |
| SUSE linux enterprise real time extension | = 11-sp4 | No fix listed |
| SUSE linux enterprise real time extension | = 12-sp2 | No fix listed |
| SUSE linux enterprise real time extension | = 12-sp3 | No fix listed |
| SUSE linux enterprise server | = 11-sp3 | No fix listed |
| SUSE linux enterprise server | = 11-sp4 | No fix listed |
| SUSE linux enterprise server | = 12 | No fix listed |
| SUSE linux enterprise server | = 12-sp1 | No fix listed |
| SUSE linux enterprise server | = 12-sp2 | No fix listed |
| SUSE linux enterprise server | = 12-sp3 | No fix listed |
| SUSE linux enterprise software development kit | = 11-sp4 | No fix listed |
| SUSE linux enterprise software development kit | = 12-sp2 | No fix listed |
| SUSE linux enterprise software development kit | = 12-sp3 | No fix listed |
| SUSE linux enterprise workstation extension | = 12-sp2 | No fix listed |
| SUSE linux enterprise workstation extension | = 12-sp3 | No fix listed |
| OpenStack cloud magnum orchestration | = 7 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| redhat mrg realtime | = 2.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux eus | = 7.3 | No fix listed |
| redhat enterprise linux eus | = 7.4 | No fix listed |
| redhat enterprise linux eus | = 7.6 | No fix listed |
| redhat enterprise linux eus | = 7.7 | No fix listed |
| redhat enterprise linux for real time | = 7 | No fix listed |
| redhat enterprise linux for real time for nfv | = 7 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server aus | = 7.7 | No fix listed |
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.4 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.7 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- USN-3583-1 vendor-advisory
- USN-3583-2 vendor-advisory
- www.cve.org
- bugs.launchpad.net issue-tracking third-party-advisory
- Debian Security Tracker CVE-2017-18017 vendor-advisory
- git.kernel.org patch third-party-advisory
- SUSE-SU-2018:0383 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2018:0408 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2018:0416 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2018:0482 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2018:0555 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2018:0660 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2018:0834 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2018:0841 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2018:0848 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2018:0986 mailing-list third-party-advisory vendor-advisory
- patchwork.ozlabs.org patch third-party-advisory
- 102367 broken-link third-party-advisory vdb-entry
- USN-3583-1 third-party-advisory vendor-advisory
- USN-3583-2 third-party-advisory vendor-advisory
- RHSA-2018:0676 third-party-advisory vendor-advisory
- RHSA-2018:1062 third-party-advisory vendor-advisory
- RHSA-2018:1130 third-party-advisory vendor-advisory
- RHSA-2018:1170 third-party-advisory vendor-advisory
- RHSA-2018:1319 third-party-advisory vendor-advisory
- RHSA-2018:1737 third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- help.ecostruxureit.com third-party-advisory
- [debian-lts-announce] 20180502 [SECURITY] [DLA 1369-1] linux security update mailing-list third-party-advisory
- lkml.org third-party-advisory
- support.f5.com third-party-advisory
- USN-3583-1 third-party-advisory vendor-advisory
- USN-3583-2 third-party-advisory vendor-advisory
- www.arista.com mitigation third-party-advisory
- DSA-4187 third-party-advisory vendor-advisory
- www.kernel.org release-notes vendor-advisory
- security.netapp.com