CVE-2017-8890

CVE-2017-8890 is a Linux kernel vulnerability affecting the IPv4 networking stack. The issue is a double free in inet_csk_clone_lock() in net/ipv4/inet_connection_sock.c, which can be triggered via the accept() system call and leads to a denial of service (kernel memory corruption/crash). The Cen...

CVE-2017-1000251

CVE-2017-1000251 affects the Linux kernel Bluetooth subsystem (BlueZ) in L2CAP processing, causing a stack buffer overflow when handling configuration responses. Affected range includes kernels from 2.6.32 up to 4.13.1. Exploitation could crash the system or, in some deployments, allow remote cod...

CVE-2017-7308

CVE-2017-7308 applies to the Linux kernel AF_PACKET packet_set_ring implementation. The issue arises from insufficient validation of certain block-size data in net/packet/af_packet.c, enabling a local user with CAP_NET_RAW to trigger a denial of service (integer signedness error and out-of-bounds...

CVE-2017-6074

CVE-2017-6074 affects the Linux kernel up to 4.9.11, where dccp_rcv_state_process in net/dccp/input.c mishandles DCCP_PKT_REQUEST data in LISTEN state. This can allow a local user to gain root privileges or trigger a denial of service (double free) via an application using IPV6_RECVPKTINFO setsoc...

CVE-2017-11176

CVE-2017-11176 is a local vulnerability in the Linux kernel’s Netlink mq_notify path. The issue arises because mq_notify does not set the sock pointer to NULL when entering retry logic, enabling a use-after-free scenario during a user-space close of a Netlink socket. Public sources describe poten...

CVE-2017-1000379

The CVE-2017-1000379 entry concerns the Linux kernel (AMD64) where the kernel may map PIE/heap/ld.so contents to the stack, enabling stack manipulation. Documents indicate affected version: Linux kernel 4.11.5. Nessus-derived items (Unity Linux UTSA advisories) reiterate the same description but ...

CVE-2017-1000371

CVE-2017-1000371 is a Linux kernel vulnerability reported for the 4.11.5 release, caused by the offset2lib patch that can allow a stack/heap clash for 32-bit PIE binaries when RLIMIT_STACK is RLIMIT_INFINITY and 1 GB is allocated. Consequences include potential local impact (stack guard page bypa...

CVE-2017-7895

CVE-2017-7895 affects the Linux kernel NFSv2/v3 server (fs/nfsd/nfs3xdr.c, fs/nfsd/nfsxdr.c). A remote attacker can craft requests that bypass end-of-buffer checks, triggering pointer-arithmetic errors or other unspecified impacts. Affected kernels include up to 4.10.13; remediation is to upgrade...

CVE-2017-8824

CVE-2017-8824 affects the Linux kernel DCCP implementation. The bug is a use-after-free in dccp_disconnect (net/dccp/proto.c) that can be triggered by an AF_UNSPEC connect while in the DCCP_LISTEN state, allowing a local user to escalate privileges or cause a denial of service. Public advisories ...

CVE-2017-10661

CVE-2017-10661 is a race condition in Linux kernel timerfd (fs/timerfd.c) that affects versions before 4.10.15. The flaw arises from improper protection of the might_cancel queue during concurrent timerfd operations, enabling local attackers to cause a denial of service or gain privileges via lis...

CVE-2017-16939

CVE-2017-16939 affects the Linux kernel XFRM Netlink path. The use-after-free occurs in the XFRM dump policy code (net/xfrm/xfrm_user.c) when a crafted SO_RCVBUF setsockopt is used with XFRM_MSG_GETPOLICY, allowing a local attacker with CAP_NET_ADMIN to trigger a denial of service or potentially ...

CVE-2017-15115

CVE-2017-15115: Linux kernel prior to 4.14 allows local users to trigger a denial of service (use-after-free in sctp_do_peeloff in net/sctp/socket.c) via crafted system calls. Impact is system crash; no explicit exploit details provided in the documents beyond this. The IBM bulletin references th...

CVE-2017-17805

CVE-2017-17805 affects the Linux kernel prior to 4.14.8. The Salsa20 cipher implementation (crypto/salsa20_generic.c and arch/x86/crypto/salsa20_glue.c) mishandles zero-length inputs, allowing a local attacker to use the AF_ALG-based skcipher interface to trigger uninitialized memory free and ker...

CVE-2017-1000111

CVE-2017-1000111 describes a heap/out-of-bounds race in the Linux kernel’s AF_PACKET socket handling (packet_set_ring) that can be exploited by a local user possessing CAP_NET_RAW to elevate privileges. The issue arises when a socket option changes socket state and races with safety checks; the r...

CVE-2016-10229

The CVE-2016-10229 issue affects the Linux kernel’s UDP handling: udp.c in versions before 4.5 contains an unsafe second checksum calculation when a recv call uses MSG_PEEK, enabling remote code execution. Reports and advisories (e.g., ALAS-2017-832, Alpine, Debian, Broadcom/Big-IP advisories) co...

CVE-2017-7889

CVE-2017-7889 affects the Linux kernel mm subsystem (up to 3.2); a local attacker with access to /dev/mem can read/write kernel memory due to CONFIG_STRICT_DEVMEM not being properly enforced in arch/x86/mm/init.c and drivers/char/mem.c. Public details: Debian security advisories show fixes (e.g.,...

CVE-2017-7541

CVE-2017-7541 affects the Broadcom WLAN driver in the Linux kernel (brcmf_cfg80211_mgmt_tx in cfg80211.c). A crafted NL80211_CMD_FRAME Netlink packet can cause kernel memory corruption, leading to DoS or possible privilege escalation. Public details in connected CentOS security advisories confirm...

CVE-2016-8399

CVE-2016-8399 affects the Linux kernel networking subsystem. The issue arises from the ICMP header length not being properly validated, enabling a local attacker to trigger an out-of-bounds memory access. With CAP_NET_ADMIN, this could lead to privilege escalation or information disclosure, as de...

CVE-2017-7184

The CVE-2017-7184 issue affects the Linux kernel xfrm subsystem, where xfrm_replay_verify_len in net/xfrm/xfrm_user.c up to 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, enabling a local attacker with CAP_NET_ADMIN to cause a heap-based out-of-bounds access and potent...

CVE-2017-11600

CVE-2017-11600 affects the Linux kernel xfrm subsystem (net/xfrm/xfrm_policy.c) where, when CONFIG_XFRM_MIGRATE is enabled, the dir value of xfrm_userpolicy_id is not constrained to XFRM_POLICY_MAX. This can allow a local user (CAP_NET_ADMIN) to cause a denial of service (out-of-bounds access) an...

CVE-2017-15265

CVE-2017-15265 is a race condition in the ALSA sequencer subsystem of the Linux kernel, up to version 4.13.8. A local attacker can trigger a use-after-free via crafted /dev/snd/seq ioctl calls, leading to denial of service (crash) or potentially other impacts. The vulnerability is fixed in the up...

CVE-2017-7645

The CVE-2017-7645 issue affects the Linux kernel NFSv2/v3 server (nfsd) and is triggered by processing long RPC replies. The root cause is an out-of-bounds memory access in the NFS server paths (net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, fs/nfsd/nfsxdr.c) that can lead to a system crash (DoS). Affected...

CVE-2017-2636

CVE-2017-2636 details (NORMAL mode) : A race condition in the Linux kernel N_HLDC driver (n_hdlc) can lead to a double free. A local, unprivileged user who sets the HDLC line discipline on a tty device could exploit this to escalate privileges or cause a denial of service (system crash). Exploita...

CVE-2017-10810

CVE-2017-10810: Linux kernel memory leak in virtio_gpu_object_create (drivers/gpu/drm/virtio/virtgpu_object.c) up to 4.11.8 can cause memory exhaustion and denial of service when object initialisation fails. Connected Nessus advisories (Unity Linux UTSA-2026-002867/002763/000604) reproduce the sa...

CVE-2017-9075

CVE-2017-9075 affects the Linux kernel network subsystem: the sctp_v6_create_accept_sk function in net/sctp/ipv6.c mishandles inheritance, enabling a local attacker to cause a denial of service (and possibly other effects) via crafted system calls. Connected CentOS Red Hat advisories (e.g., CESA/...

CVE-2017-9074

Affected software: Linux kernel IPv6 fragmentation code. Root cause: nexthdr field may be associated with an invalid option, leading to an out-of-bounds read/BUG via crafted socket and send calls. Impact: local denial of service and potential unspecified effects (information leakage/compromise as...

CVE-2017-7618

CVE-2017-7618 affects the Linux kernel crypto/ahash.c, enabling denial of service by triggering EBUSY on a full request queue and causing infinite recursion in the AHASH path. The issue is referenced across multiple connected advisories (Cloud Foundry USN-3312-2, CNVD-2017-05429, Debian DLA-922-1...

CVE-2017-12146

The CVE-2017-12146 issue affects the Linux kernel driver_override in drivers/base/platform.c prior to 4.12.1. A race between reads and stores of different overrides can allow a local user to gain privileges. Evidence from connected Nessus advisories (Unity Linux, EulerOS, OracleVM) confirms the v...

CVE-2017-17806

CVE-2017-17806 affects the Linux kernel before 4.14.8. The HMAC implementation (crypto/hmac.c) does not validate that the underlying hash algorithm is unkeyed, allowing a local attacker who can use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and SHA-3 (CONFIG_CRYPTO_SHA3) to tri...

CVE-2017-17712

Technical details about CVE-2017-17712 are not publicly available in the provided connected documents. Monitor for updates from vendor advisories and upstream kernel patches.

CVE-2017-1000363

CVE-2017-1000363: Linux kernel lp driver bounds-check flaw in lp.c allows a local attacker with write access to kernel command line arguments to overflow parport_nr and execute arbitrary code. Root cause: missing bounds check in arg handling. Public disclosures include Debian security advisories ...

CVE-2017-1000365

CVE-2017-1000365 affects the Linux kernel where size limits for arguments and environment strings passed via RLIMIT_STACK/RLIMIT_INFINITY do not properly account for the argument/environment pointers, enabling a local attacker to potentially execute arbitrary code. The issue is described as a lim...

CVE-2017-1000370

CVE-2017-1000370 affects the Linux kernel (4.11.5 and earlier) on i386. The offset2lib patch vulnerability lets a PIE binary be execve’d with an enormous 1 GB argument/environment list, causing the stack to occupy 0x80000000 and the PIE binary to be mapped above 0x40000000, bypassing the patch’s ...

CVE-2017-7187

The CVE-2017-7187 issue affects the Linux kernel sg_ioctl in drivers/scsi/sg.c, where a large SG_NEXT_CMD_LEN ioctl can trigger a stack-based buffer overflow, leading to a DoS or potentially other impact via out-of-bounds writes in sg_write. Descriptions across connected sources (CNVD-2017-03858)...

CVE-2017-6346

CVE-2017-6346 affects the Linux kernel net/packet/af_packet.c, describing a race condition in the PACKET_FANOUT fanout path that can cause a use-after-free in multithreaded user apps. The connected sources confirm this is a local vulnerability with potential denial of service and possible unspeci...

CVE-2017-7294

The CVE-2017-7294 issue affects the Linux kernel up to 4.10.6, specifically vmwgfx vmw_surface_define_ioctl() in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c. A crafted ioctl to /dev/dri/renderD* can trigger an integer overflow and out-of-bounds write, causing denial of service (system hang/crash) and...

CVE-2017-11473

CVE-2017-11473 describes a buffer overflow in the Linux kernel, specifically in arch/x86/kernel/acpi/boot.c::mp_override_legacy_irq(), up to version 3.2. An attacker with local access can escalate privileges by presenting a crafted ACPI table. Exploitation is local and does not require user inter...

CVE-2017-7487

The CVE-2017-7487 issue is in the Linux kernel net/ipx/af_ipx.c ipxitf_ioctl: reference count mishandling causes a use-after-free via a failed SIOCGIFADDR on an IPX interface, enabling local denial of service. Evidence in connected Nessus advisories confirms the vulnerability and that it affects ...

CVE-2017-16525

The CVE-2017-16525 entry affects the Linux kernel: usb_serial_console_disconnect in drivers/usb/serial/console.c allows local users to trigger a denial of service (use-after-free and system crash) via a crafted USB device, with impact on confidentiality/integrity/availability as per the advisory....

CVE-2017-8797

CVE-2017-8797 affects the Linux kernel NFSv4 server. A remote attacker can send NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operands in UDP; an uninitialized layout type is used as an array index, causing an OOPS and potentially a system DoS via knfsd soft-lockup. Affected: Linux kernel versions prior ...

CVE-2017-16526

CVE-2017-16526 affects the Linux kernel driver code drivers/uwb/uwbd.c up to version 4.13.5; a crafted USB device could trigger a general protection fault and system crash via local access, potentially causing denial of service or other impact. The connected Unity Linux advisories (UTSA-2026-0016...

CVE-2017-16533

CVE-2017-16533 affects the Linux kernel’s usbhid_parse() in drivers/hid/usbhid/hid-core.c up to and including version 4.13.7; a crafted USB device can cause an out-of-bounds read, leading to local denial of service or a crash. Affected component: HID USB host controller driver (usbhid). Root caus...

CVE-2017-16532

CVE-2017-16532: A vulnerability in the Linux kernel ≤ 4.13.11 affects the get_endpoints function in drivers/usb/misc/usbtest.c, enabling local users to trigger a denial of service via a crafted USB device, through a NULL pointer dereference and potential system crash. The issue is triggered by a ...

CVE-2017-16529

CVE-2017-16529 affects the Linux kernel’s snd_usb_create_streams in sound/usb/card.c, allowing a local attacker to trigger an out-of-bounds read and system crash via a crafted USB device, with impact described as a denial of service and potentially other effects. The issue is present in kernels p...

CVE-2017-7374

CVE-2017-7374 is a use-after-free in the Linux kernel fs/crypto/ subsystem prior to 4.10.7, where revoking keyring keys used for ext4, f2fs, or ubifs encryption can free cryptographic transform objects prematurely. This enables local attackers to cause a denial of service via a NULL pointer deref...

CVE-2017-16530

CVE-2017-16530 affects the Linux kernel uas driver (drivers/usb/storage/uas.c; uas-detect.h). The issue allows a local user to trigger a denial of service or potentially other impact via a crafted USB device, caused by an out-of-bounds read. Affected condition is the uas driver in the kernel prio...

CVE-2017-16527

CVE-2017-16527 affects the Linux kernel component sound/usb/mixer.c, vulnerable before version 4.13.8. A crafted USB device can trigger a snd_usb_mixer_interrupt use-after-free, causing denial of service or system crash. Exploitation vectors are local to physical USB device interaction. The conne...

CVE-2017-16531

CVE-2017-16531 affects the Linux kernel before 4.13.6, where the driver/usb/core/config.c path allows a local user to trigger an out-of-bounds read via a crafted USB device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor. Exploitation could cause a denial of service (kernel crash) and pot...

CVE-2017-10663

CVE-2017-10663 affects the Linux kernel prior to 4.12.4, specifically the F2FS file system code (fs/f2fs/super.c). The vulnerability arises because sanity_check_ckpt does not validate blkoff and segno arrays, allowing an unprivileged, local user to trigger a system panic and potential privilege e...

CVE-2017-16528

CVE-2017-16528 affects the Linux kernel: sound/core/seq_device.c prior to version 4.13.4. A crafted USB device can trigger a use-after-free in snd_rawmidi_dev_seq_free , causing local DoS and potential system crash. Impact is described as high for confidentiality, integrity, and availability in t...