CVE-2017-18017

EPSS 52.84%
Veröffentlicht 03.01.2018 06:29:00
Zuletzt bearbeitet 03.01.2025 12:15:25
Erkennungen
Login

The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 36

NVD 66 VulnDex Vulnerability Enrichment 8

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Linux ≫ Linux Kernel Version >= 3.2 < 3.2.99

Linux ≫ Linux Kernel Version >= 3.3 < 3.10.108

Linux ≫ Linux Kernel Version >= 3.11 < 3.16.54

Linux ≫ Linux Kernel Version >= 3.17 < 3.18.60

Linux ≫ Linux Kernel Version >= 3.19 < 4.1.43

Linux ≫ Linux Kernel Version >= 4.2 < 4.4.76

Linux ≫ Linux Kernel Version >= 4.5 < 4.9.36

Linux ≫ Linux Kernel Version >= 4.10 < 4.11

Debian ≫ Debian Linux Version 7.0

Debian ≫ Debian Linux Version 8.0

Arista ≫ Eos Version 4.20.1fx-virtual-router

F5 ≫ Arx Version >= 6.2.0 <= 6.4.0

Suse ≫ Caas Platform

Suse ≫ Linux Enterprise Debuginfo Version 11 Update sp3

Suse ≫ Linux Enterprise Debuginfo Version 11 Update sp4

Suse ≫ Linux Enterprise Module For Public Cloud Version 12

Suse ≫ Linux Enterprise Point Of Sale Version 11 Update sp3

Suse ≫ Openstack Cloud Version 6

Opensuse ≫ Leap Version 42.3

Suse ≫ Linux Enterprise Desktop Version 12 Update sp2

Suse ≫ Linux Enterprise Desktop Version 12 Update sp3

Suse ≫ Linux Enterprise High Availability Version 12 Update sp2

Suse ≫ Linux Enterprise High Availability Version 12 Update sp3

Suse ≫ Linux Enterprise High Availability Extension Version 11 Update sp4

Suse ≫ Linux Enterprise Live Patching Version 12 Update -

Suse ≫ Linux Enterprise Live Patching Version 12 Update sp3

Suse ≫ Linux Enterprise Real Time Extension Version 11 Update sp4

Suse ≫ Linux Enterprise Real Time Extension Version 12 Update sp2

Suse ≫ Linux Enterprise Real Time Extension Version 12 Update sp3

Suse ≫ Linux Enterprise Server Version 11 Update sp3 SwEdition ltss

Suse ≫ Linux Enterprise Server Version 11 Update sp4

Suse ≫ Linux Enterprise Server Version 12 SwEdition ltss

Suse ≫ Linux Enterprise Server Version 12 Update sp1 SwPlatform sap

Suse ≫ Linux Enterprise Server Version 12 Update sp1 SwEdition ltss

Suse ≫ Linux Enterprise Server Version 12 Update sp2

Suse ≫ Linux Enterprise Server Version 12 Update sp2 HwPlatform raspberry_pi

Suse ≫ Linux Enterprise Server Version 12 Update sp3 SwEdition - SwPlatform -

Suse ≫ Linux Enterprise Software Development Kit Version 11 Update sp4

Suse ≫ Linux Enterprise Software Development Kit Version 12 Update sp2

Suse ≫ Linux Enterprise Software Development Kit Version 12 Update sp3

Suse ≫ Linux Enterprise Workstation Extension Version 12 Update sp2

Suse ≫ Linux Enterprise Workstation Extension Version 12 Update sp3

Openstack ≫ Cloud Magnum Orchestration Version 7

Canonical ≫ Ubuntu Linux Version 12.04 SwEdition -

Canonical ≫ Ubuntu Linux Version 14.04 SwEdition esm

Redhat ≫ Mrg Realtime Version 2.0

Redhat ≫ Enterprise Linux Desktop Version 6.0

Redhat ≫ Enterprise Linux Desktop Version 7.0

Redhat ≫ Enterprise Linux Eus Version 7.3

Redhat ≫ Enterprise Linux Eus Version 7.4

Redhat ≫ Enterprise Linux Eus Version 7.6

Redhat ≫ Enterprise Linux Eus Version 7.7

Redhat ≫ Enterprise Linux For Real Time Version 7

Redhat ≫ Enterprise Linux For Real Time For Nfv Version 7

Redhat ≫ Enterprise Linux Server Version 6.0

Redhat ≫ Enterprise Linux Server Version 7.0

Redhat ≫ Enterprise Linux Server Aus Version 7.3

Redhat ≫ Enterprise Linux Server Aus Version 7.4

Redhat ≫ Enterprise Linux Server Aus Version 7.6

Redhat ≫ Enterprise Linux Server Aus Version 7.7

Redhat ≫ Enterprise Linux Server Tus Version 7.3

Redhat ≫ Enterprise Linux Server Tus Version 7.4

Redhat ≫ Enterprise Linux Server Tus Version 7.6

Redhat ≫ Enterprise Linux Server Tus Version 7.7

Redhat ≫ Enterprise Linux Workstation Version 6.0

Redhat ≫ Enterprise Linux Workstation Version 7.0

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	52.84%	0.988

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST	10	10	10	AV:N/AC:L/Au:N/C:C/I:C/A:C

CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0676

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1062

Third Party Advisory

https://usn.ubuntu.com/3583-1/

Third Party Advisory

https://usn.ubuntu.com/3583-2/

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1319

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1130

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1170

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html

Third Party Advisory

Mailing List

https://www.debian.org/security/2018/dsa-4187

Third Party Advisory

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2638fd0f92d4397884fd991d8f4925cb3f081901

Patch

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00008.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00013.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00015.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00038.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00047.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2018-03/msg00030.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2018-03/msg00067.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2018-03/msg00070.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2018-03/msg00072.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2018-04/msg00014.html

Third Party Advisory

Mailing List

http://patchwork.ozlabs.org/patch/746618/

Patch

Third Party Advisory

http://www.securityfocus.com/bid/102367

Third Party Advisory

Broken Link

VDB Entry

http://www.ubuntu.com/usn/USN-3583-1

Third Party Advisory

http://www.ubuntu.com/usn/USN-3583-2

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1737

Third Party Advisory

https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1739765

Third Party Advisory

Issue Tracking

https://github.com/torvalds/linux/commit/2638fd0f92d4397884fd991d8f4925cb3f081901

Patch

Third Party Advisory

https://lkml.org/lkml/2017/4/2/13

Third Party Advisory

https://support.f5.com/csp/article/K18352029

Third Party Advisory

https://www.arista.com/en/support/advisories-notices/security-advisories/4577-security-advisory-34

Third Party Advisory

Mitigation

https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.36

Vendor Advisory

Release Notes

https://security.netapp.com/advisory/ntap-20250103-0010/

https://nvd.nist.gov/vuln/detail/CVE-2017-18017

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-18017

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-18017

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2017-18017