CVE-2017-8797

2017-07-0200:00:00

ubuntu.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.874 High

EPSS

Percentile

98.6%

JSON

The NFSv4 server in the Linux kernel before 4.11.3 does not properly
validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or
LAYOUTGET operand in a UDP packet from a remote attacker. This type value
is uninitialized upon encountering certain error conditions. This value is
used as an array index for dereferencing, which leads to an OOPS and
eventually a DoS of knfsd and a soft-lockup of the whole system.

OSVersionArchitecturePackageVersionFilename
ubuntu16.04noarchlinux< 4.4.0-83.106UNKNOWN
ubuntu16.04noarchlinux-aws< 4.4.0-1022.31UNKNOWN
ubuntu16.04noarchlinux-gcp< 4.13.0-1002.5UNKNOWN
ubuntu16.04noarchlinux-hwe< 4.13.0-26.29~16.04.2UNKNOWN
ubuntu16.04noarchlinux-hwe-edge< 4.13.0-26.29~16.04.2UNKNOWN
ubuntu14.04noarchlinux-lts-xenial< 4.4.0-83.106~14.04.1UNKNOWN
ubuntu16.04noarchlinux-raspi2< 4.4.0-1061.69UNKNOWN
ubuntu16.04noarchlinux-snapdragon< 4.4.0-1063.68UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	16.04	noarch	linux	< 4.4.0-83.106	UNKNOWN
ubuntu	16.04	noarch	linux-aws	< 4.4.0-1022.31	UNKNOWN
ubuntu	16.04	noarch	linux-gcp	< 4.13.0-1002.5	UNKNOWN
ubuntu	16.04	noarch	linux-hwe	< 4.13.0-26.29~16.04.2	UNKNOWN
ubuntu	16.04	noarch	linux-hwe-edge	< 4.13.0-26.29~16.04.2	UNKNOWN
ubuntu	14.04	noarch	linux-lts-xenial	< 4.4.0-83.106~14.04.1	UNKNOWN
ubuntu	16.04	noarch	linux-raspi2	< 4.4.0-1061.69	UNKNOWN
ubuntu	16.04	noarch	linux-snapdragon	< 4.4.0-1063.68	UNKNOWN