CVE-2017-18222: linux linux_kernel

Vulnerability summary

CVE-2017-18222 is a high (CVSS 7.8) vulnerability in linux linux_kernel. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 40.3% of scored vulnerabilities.

Timeline

1. 08-03-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

In the Linux kernel before 4.12, Hisilicon Network Subsystem (HNS) does not consider the ETH_SS_PRIV_FLAGS case when retrieving sset_count data, which allows local users to cause a denial of service (buffer overflow and memory corruption) or possibly have unspecified other impact, as demonstrated by incompatibility between hns_get_sset_count and ethtool_get_strings.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.