7.8

CVE-2017-17805

The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 2.6.25 < 3.2.97
Linux ≫ Linux Kernel Version >= 3.3 < 3.16.52
Linux ≫ Linux Kernel Version >= 3.17 < 3.18.89
Linux ≫ Linux Kernel Version >= 3.19 < 4.1.49
Linux ≫ Linux Kernel Version >= 4.2 < 4.4.107
Linux ≫ Linux Kernel Version >= 4.5 < 4.9.71
Linux ≫ Linux Kernel Version >= 4.10 < 4.14.8
Debian ≫ Debian Linux Version 8.0
Debian ≫ Debian Linux Version 9.0
Opensuse ≫ Leap Version 42.2
Opensuse Project ≫ Leap Version 42.3
Suse ≫ Linux Enterprise Desktop Version 12 Update sp2
Suse ≫ Linux Enterprise Desktop Version 12 Update sp3
Suse ≫ Linux Enterprise Server Version 11 Update extra
Suse ≫ Linux Enterprise Server Version 11 Update sp4
Suse ≫ Linux Enterprise Server Version 12 Update sp2
Suse ≫ Linux Enterprise Server Version 12 Update sp3
Canonical ≫ Ubuntu Linux Version 12.04 SwEdition -
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition esm
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition esm
Canonical ≫ Ubuntu Linux Version 17.10
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.43% 0.343
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://access.redhat.com/errata/RHSA-2018:3083
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3096
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html
Third Party Advisory
https://usn.ubuntu.com/3619-1/
Third Party Advisory
https://usn.ubuntu.com/3619-2/
Third Party Advisory
https://usn.ubuntu.com/3620-1/
Third Party Advisory
https://usn.ubuntu.com/3620-2/
Third Party Advisory
https://usn.ubuntu.com/3617-1/
Third Party Advisory
https://usn.ubuntu.com/3617-2/
Third Party Advisory
https://usn.ubuntu.com/3617-3/
Third Party Advisory
https://www.debian.org/security/2017/dsa-4073
Third Party Advisory
https://www.debian.org/security/2018/dsa-4082
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2948
Third Party Advisory
https://usn.ubuntu.com/3632-1/
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/01/msg00004.html
Third Party Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ecaaab5649781c5a0effdaf298a925063020500e
Patch
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.html
Third Party Advisory
http://www.securityfocus.com/bid/102291
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:2473
Third Party Advisory
https://github.com/torvalds/linux/commit/ecaaab5649781c5a0effdaf298a925063020500e
Patch
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.8
Release Notes
Issue Tracking