CVE-2017-14497: debian debian_linux

Modified

AliasesUBUNTU-CVE-2017-14497DEBIAN-CVE-2017-14497

Published 15-09-2017Last modified 05-08-2024

Vulnerability summary

CVE-2017-14497 is a high (CVSS 7.8) vulnerability in debian debian_linux. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 46.4% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.8/10

010

High · v3.1 (NVD)

EPSS score

0.56%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3

MGASA-2017-0381 MGASA-2017-0383 MGASA-2017-0384

Timeline

15-09-2017
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

The tpacket_rcv function in net/packet/af_packet.c in the Linux kernel before 4.13 mishandles vnet headers, which might allow local users to cause a denial of service (buffer overflow, and disk and memory corruption) or possibly have unspecified other impact via crafted system calls.

CVSS metrics

5 scores · 3 sources · 3 versions

v3.17.8v3.07.8v2.07.2

EPSS trend

Probability

0.56%

Chance of exploitation in the next 30 days

Percentile

46%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.56% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu12 products

linux-azure< 4.13.0-1005.7 | All versions (No fix recorded)
linux-azure-fdeAll versions (No fix recorded)
linux-gcp< 4.13.0-1002.5 | All versions (No fix recorded)
linux-gkeAll versions (No fix recorded)
linux-hwe< 4.13.0-32.35~16.04.1 | All versions (No fix recorded)

Show all 12

Debian2 products

linux< 4.12.13-1
debian_linuxEOL8.0 | 9.0

Linux1 product

linux_kernel≥ 4.6, < 4.9.51 | ≥ 4.10, < 4.12.14

3 vendors · 15 products

References

14 links

marc.info?l=linux-kernel&m=150394500728906&w=2X Refsource CONFIRMMailing ListPatchThird Party AdvisoryREPORT
bugzilla.redhat.com/show_bug.cgi?id=1492593X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
seclists.org/oss-sec/2017/q3/476Mailing ListX Refsource MLISTThird Party Advisory
www.securitytracker.com/id/1039371VDB EntryX Refsource SECTRACKThird Party Advisory
www.securityfocus.com/bid/100871VDB EntryX Refsource BIDThird Party Advisory
source.android.com/security/bulletin/2018-01-01X Refsource CONFIRMThird Party Advisory
www.debian.org/security/2017/dsa-3981Vendor AdvisoryX Refsource DEBIANThird Party Advisory
github.com/torvalds/linux/commit/edbd58be15a957f6a760c4a514cd475217eb97fdX Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryREPORT
marc.info?t=150394517700001&r=1&w=2X Refsource CONFIRMMailing ListPatchThird Party AdvisoryREPORT
git.kernel.org/cgit/…X Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryREPORT

Show all 14 references

www.securitytracker.com/id/1040106VDB EntryX Refsource SECTRACKThird Party Advisory
ubuntu.com/security/CVE-2017-14497REPORT
www.cve.org/CVERecord?id=CVE-2017-14497REPORT
security-tracker.debian.org/tracker/CVE-2017-14497Advisory