CVE-2017-17857
The check_stack_boundary function in kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of invalid variable…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The check_stack_boundary function in kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of invalid variable stack read operations.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.39% probability · 33th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- linux/linux kernel · debian/debian linux
- Source
- cve@mitre.org
References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ea25f914dc164c8d56b36147ecc86bc65f83c469Vendor Advisory
- http://www.openwall.com/lists/oss-security/2017/12/21/2Mailing List, Third Party Advisory
- https://github.com/torvalds/linux/commit/ea25f914dc164c8d56b36147ecc86bc65f83c469Patch, Third Party Advisory
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ea25f914dc164c8d56b36147ecc86bc65f83c469Vendor Advisory
- http://www.openwall.com/lists/oss-security/2017/12/21/2Mailing List, Third Party Advisory
- https://github.com/torvalds/linux/commit/ea25f914dc164c8d56b36147ecc86bc65f83c469Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.