Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-7184

The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, which allows local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-image-* package 4.8.0.41.52.

Published

2017-03-19T18:59:00.193

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.1: 7.8 (HIGH)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Access Vector: LOCAL
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

3.9

Impact Score

10.0

Weaknesses

Type: Primary
NVD-CWE-noinfo

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	linux	linux_kernel	4.8	Yes
Operating System	canonical	ubuntu_linux	16.10	No
Operating System	linux	linux_kernel	< 3.2.89	Yes
Operating System	linux	linux_kernel	< 3.10.106	Yes
Operating System	linux	linux_kernel	< 3.12.73	Yes
Operating System	linux	linux_kernel	< 3.16.44	Yes
Operating System	linux	linux_kernel	< 3.18.49	Yes
Operating System	linux	linux_kernel	< 4.1.49	Yes
Operating System	linux	linux_kernel	< 4.4.59	Yes
Operating System	linux	linux_kernel	< 4.9.20	Yes
Operating System	linux	linux_kernel	< 4.10.8	Yes

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=677e806da4d916052585301785d847c3b3e6186a Vendor Advisory ([email protected])
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f843ee6dd019bcece3e74e76ad9df0155655d0df Vendor Advisory ([email protected])
http://openwall.com/lists/oss-security/2017/03/29/2 Mailing List, Third Party Advisory ([email protected])
http://www.eweek.com/security/ubuntu-linux-falls-on-day-1-of-pwn2own-hacking-competition Technical Description, Third Party Advisory ([email protected])
http://www.securityfocus.com/bid/97018 Third Party Advisory, VDB Entry ([email protected])
http://www.securitytracker.com/id/1038166 Third Party Advisory, VDB Entry ([email protected])
https://access.redhat.com/errata/RHSA-2017:2918 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2017:2930 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2017:2931 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2019:4159 Third Party Advisory ([email protected])
https://blog.trendmicro.com/results-pwn2own-2017-day-one/ Technical Description, Third Party Advisory ([email protected])
https://github.com/torvalds/linux/commit/677e806da4d916052585301785d847c3b3e6186a Third Party Advisory ([email protected])
https://github.com/torvalds/linux/commit/f843ee6dd019bcece3e74e76ad9df0155655d0df Third Party Advisory ([email protected])
https://source.android.com/security/bulletin/2017-05-01 Third Party Advisory ([email protected])
https://twitter.com/thezdi/status/842126074435665920 Press/Media Coverage, Third Party Advisory ([email protected])
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=677e806da4d916052585301785d847c3b3e6186a Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f843ee6dd019bcece3e74e76ad9df0155655d0df Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://openwall.com/lists/oss-security/2017/03/29/2 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.eweek.com/security/ubuntu-linux-falls-on-day-1-of-pwn2own-hacking-competition Technical Description, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/97018 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1038166 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2017:2918 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2017:2930 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2017:2931 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2019:4159 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://blog.trendmicro.com/results-pwn2own-2017-day-one/ Technical Description, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/torvalds/linux/commit/677e806da4d916052585301785d847c3b3e6186a Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/torvalds/linux/commit/f843ee6dd019bcece3e74e76ad9df0155655d0df Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://source.android.com/security/bulletin/2017-05-01 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://twitter.com/thezdi/status/842126074435665920 Press/Media Coverage, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)