8

CVE-2017-1000251: debian debian_linux Out-of-bounds Write

Modified
AliasesSUSE-SU-2017:2459-1SUSE-SU-2017:2521-1SUSE-SU-2017:2523-1
Published 12-09-2017Last modified 05-08-2024

Vulnerability summary

CVE-2017-1000251 is a high (CVSS 8.0) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 16.18% chance of exploitation in the next 30 days, higher than 96.9% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (exploit-database, 21-09-2017)

Source freshness unavailable

How is this decided?
CVSS score
8.0/10
010
High · v3.1 (NVD)
EPSS score
16.18%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 55 · Related 46
DLA-1099-1DSA-3981-1MGASA-2017-0342MGASA-2017-0343MGASA-2017-0344MGASA-2017-0345

Timeline

  1. 12-09-2017
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space.

CVSS metrics

6 scores · 4 sources · 3 versions

EPSS trend

Probability

16.18%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 16.18% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • exploit-databasedoslinuxUnverified

    Linux Kernel < 4.13.1 - BlueTooth Buffer Overflow (PoC)

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: adjacent network, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse72 products
  • kernel-bigmem&distro=SUSE Linux Enterprise Server 11 SP4< 3.0.101-108.10.1
  • kernel-bigmem&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4< 3.0.101-108.10.1
  • kernel-default&distro=SUSE Linux Enterprise Desktop 12 SP2< 4.4.74-92.38.1
  • kernel-default&distro=SUSE Linux Enterprise Desktop 12 SP3< 4.4.82-6.6.1
  • kernel-default&distro=SUSE Linux Enterprise High Availability Extension 12 SP2< 4.4.74-92.38.1
Redhat54 products
Ubuntu14 products
  • linux< 3.13.0-132.181 | < 4.4.0-96.119
  • linux-aws< 4.4.0-1035.44
  • linux-azure< 4.13.0-1005.7
  • linux-azure-fdeAll versions (No fix recorded)
  • linux-gcp< 4.10.0-1006.6
Debian2 products
Nvidia2 products
Linux1 product
  • linux_kernel≥ 2.6.32, < 3.2.94 | ≥ 3.3, < 3.16.49 | ≥ 3.17, < 3.18.71 | ≥ 3.19, < 4.1.45 | ≥ 4.2, < 4.4.88 | ≥ 4.5, < 4.9.50 | ≥ 4.10, < 4.12.13 | ≥ 4.13, < 4.13.2

6 vendors · 145 products

References

59 links
Show all 59 references