7.8

CVE-2017-7308

The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate certain block-size data, which allows local users to cause a denial of service (integer signedness error and out-of-bounds write), or gain privileges (if the CAP_NET_RAW capability is held), via crafted system calls.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 2.6.27 < 3.2.89
Linux ≫ Linux Kernel Version >= 3.3 < 3.10.107
Linux ≫ Linux Kernel Version >= 3.11 < 3.12.74
Linux ≫ Linux Kernel Version >= 3.13 < 3.16.44
Linux ≫ Linux Kernel Version >= 3.17 < 3.18.52
Linux ≫ Linux Kernel Version >= 3.19 < 4.1.41
Linux ≫ Linux Kernel Version >= 4.2 < 4.4.66
Linux ≫ Linux Kernel Version >= 4.5 < 4.9.26
Linux ≫ Linux Kernel Version >= 4.10 < 4.10.14
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 17.83% 0.968
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
CWE-681 Incorrect Conversion between Numeric Types

When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://source.android.com/security/bulletin/2017-07-01
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1854
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1297
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1298
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1308
Third Party Advisory
http://www.securityfocus.com/bid/97234
Third Party Advisory
VDB Entry
https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html
Third Party Advisory
https://patchwork.ozlabs.org/patch/744811/
Third Party Advisory
https://patchwork.ozlabs.org/patch/744812/
Third Party Advisory
https://patchwork.ozlabs.org/patch/744813/
Third Party Advisory
https://www.exploit-db.com/exploits/41994/
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/44654/
Third Party Advisory
VDB Entry