CVE-2017-7308 The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate certain block-size data, which allows local users to cause a denial of service (int...
HighCVSS 7.8
EPSS 17.8%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate certain block-size data, which allows local users to cause a denial of service (integer signedness error and out-of-bounds write), or gain privileges (if the CAP_NET_RAW capability is held), via crafted system calls.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 4.9.18-1 | 4.9.18-1 |
| debian/linux(Debian:13) | < 4.9.18-1 | 4.9.18-1 |
| debian/linux(Debian:14) | < 4.9.18-1 | 4.9.18-1 |
| Linux kernel | >= 2.6.27, < 3.2.89 | 3.2.89 |
| Linux kernel | >= 3.3, < 3.10.107 | 3.10.107 |
| Linux kernel | >= 3.11, < 3.12.74 | 3.12.74 |
| Linux kernel | >= 3.13, < 3.16.44 | 3.16.44 |
| Linux kernel | >= 3.17, < 3.18.52 | 3.18.52 |
| Linux kernel | >= 3.19, < 4.1.41 | 4.1.41 |
| Linux kernel | >= 4.2, < 4.4.66 | 4.4.66 |
| Linux kernel | >= 4.5, < 4.9.26 | 4.9.26 |
| Linux kernel | >= 4.10, < 4.10.14 | 4.10.14 |
References
- Debian Security Tracker CVE-2017-7308 vendor-advisory
- 97234 third-party-advisory vdb-entry
- RHSA-2017:1297 third-party-advisory vendor-advisory
- RHSA-2017:1298 third-party-advisory vendor-advisory
- RHSA-2017:1308 third-party-advisory vendor-advisory
- RHSA-2018:1854 third-party-advisory vendor-advisory
- googleprojectzero.blogspot.com third-party-advisory
- patchwork.ozlabs.org third-party-advisory
- patchwork.ozlabs.org third-party-advisory
- patchwork.ozlabs.org third-party-advisory
- source.android.com third-party-advisory
- 41994 exploit third-party-advisory vdb-entry
- 44654 exploit third-party-advisory vdb-entry