CVE-2017-9074

2017-05-1900:00:00

ubuntu.com

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

The IPv6 fragmentation implementation in the Linux kernel through 4.11.1
does not consider that the nexthdr field may be associated with an invalid
option, which allows local users to cause a denial of service
(out-of-bounds read and BUG) or possibly have unspecified other impact via
crafted socket and send system calls.

OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchlinux< 3.13.0-123.172UNKNOWN
ubuntu16.04noarchlinux< 4.4.0-83.106UNKNOWN
ubuntu16.10noarchlinux< 4.8.0-58.63UNKNOWN
ubuntu17.04noarchlinux< 4.10.0-26.30UNKNOWN
ubuntu16.04noarchlinux-aws< 4.4.0-1022.31UNKNOWN
ubuntu16.04noarchlinux-gke< 4.4.0-1018.18UNKNOWN
ubuntu16.04noarchlinux-hwe< 4.8.0-58.63~16.04.1UNKNOWN
ubuntu18.04noarchlinux-hwe-edge< 4.18.0-8.9~18.04.1UNKNOWN
ubuntu16.04noarchlinux-hwe-edge< 4.8.0-58.63~16.04.1UNKNOWN
ubuntu14.04noarchlinux-lts-xenial< 4.4.0-83.106~14.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	14.04	noarch	linux	< 3.13.0-123.172	UNKNOWN
ubuntu	16.04	noarch	linux	< 4.4.0-83.106	UNKNOWN
ubuntu	16.10	noarch	linux	< 4.8.0-58.63	UNKNOWN
ubuntu	17.04	noarch	linux	< 4.10.0-26.30	UNKNOWN
ubuntu	16.04	noarch	linux-aws	< 4.4.0-1022.31	UNKNOWN
ubuntu	16.04	noarch	linux-gke	< 4.4.0-1018.18	UNKNOWN
ubuntu	16.04	noarch	linux-hwe	< 4.8.0-58.63~16.04.1	UNKNOWN
ubuntu	18.04	noarch	linux-hwe-edge	< 4.18.0-8.9~18.04.1	UNKNOWN
ubuntu	16.04	noarch	linux-hwe-edge	< 4.8.0-58.63~16.04.1	UNKNOWN
ubuntu	14.04	noarch	linux-lts-xenial	< 4.4.0-83.106~14.04.1	UNKNOWN