7.8
CVE-2017-10663
- EPSS 0.44%
- Veröffentlicht 19.08.2017 18:29:00
- Zuletzt bearbeitet 13.05.2026 00:24:29
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
The sanity_check_ckpt function in fs/f2fs/super.c in the Linux kernel before 4.12.4 does not validate the blkoff and segno arrays, which allows local users to gain privileges via unspecified vectors.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 3.8 < 3.18.64
Linux ≫ Linux Kernel Version >= 3.19 < 4.1.44
Linux ≫ Linux Kernel Version >= 4.2 < 4.4.81
Linux ≫ Linux Kernel Version >= 4.5 < 4.9.42
Linux ≫ Linux Kernel Version >= 4.10 < 4.12.4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.44% | 0.347 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.8 | 1.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 7.2 | 3.9 | 10 |
AV:L/AC:L/Au:N/C:C/I:C/A:C
|
CWE-129 Improper Validation of Array Index
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
https://source.android.com/security/bulletin/2017-08-01
http://www.securityfocus.com/bid/100215
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=15d3042a937c13f5d9244241c7a9c8416ff6e82a
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.4
https://bugzilla.redhat.com/show_bug.cgi?id=1481149
https://github.com/torvalds/linux/commit/15d3042a937c13f5d9244241c7a9c8416ff6e82a