7.8

CVE-2017-8797

The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This type value is uninitialized upon encountering certain error conditions. This value is used as an array index for dereferencing, which leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the whole system.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.0 < 4.1.40
Linux ≫ Linux Kernel Version >= 4.2 < 4.4.70
Linux ≫ Linux Kernel Version >= 4.5 < 4.9.30
Linux ≫ Linux Kernel Version >= 4.11 < 4.11.3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 8.67% 0.944
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 7.8 10 6.9
AV:N/AC:L/Au:N/C:N/I:N/A:C
CWE-129 Improper Validation of Array Index

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

https://access.redhat.com/errata/RHSA-2017:1842
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2077
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2669
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2437
Third Party Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b550a32e60a4941994b437a8d662432a486235a5
Patch
Vendor Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f961e3f2acae94b727380c0b74e2d3954d0edf79
Patch
Vendor Advisory
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.3
Vendor Advisory
Release Notes
http://www.openwall.com/lists/oss-security/2017/06/27/5
Patch
VDB Entry
Mailing List
http://www.securityfocus.com/bid/99298
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1038790
Third Party Advisory
Broken Link
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1466329
Third Party Advisory
VDB Entry
Issue Tracking
https://github.com/torvalds/linux/commit/b550a32e60a4941994b437a8d662432a486235a5
Patch
Third Party Advisory
https://github.com/torvalds/linux/commit/f961e3f2acae94b727380c0b74e2d3954d0edf79
Patch
Third Party Advisory