SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2017-7895

The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted…

CRITICAL 9.8EPSS 10.8%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 10.8%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.

Description

The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.

CVSS 3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
10.81% probability · 96th percentile
CISA KEV
Not listed
Weakness
CWE-119
Affected
linux/linux kernel · debian/debian linux
Source
cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.