CVE-2017-2634: linux kernel: NULL Pointer Dereference
Vulnerability summary
CVE-2017-2634 is a high (CVSS 7.8) NULL Pointer Dereference vulnerability in linux kernel:. EPSS estimates a 5.15% chance of exploitation in the next 30 days, higher than 92.4% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 5% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3Timeline
- 27-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
It was found that the Linux kernel's Datagram Congestion Control Protocol (DCCP) implementation before 2.6.22.17 used the IPv4-only inet_sk_rebuild_header() function for both IPv4 and IPv6 DCCP connections, which could result in memory corruptions. A remote attacker could use this flaw to crash the system.
CVSS metrics
4 scores · 3 sources · 2 versions- NVDNIST7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
5.15%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
No change 0.00 pp
From 5.15% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.
- CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu11 products
- linux< 3.11.0-12.19 | < 4.2.0-16.19
- linux-aws< 4.4.0-1002.2 | < 4.4.0-1001.10
- linux-flo< 3.4.0-5.22
- linux-gke< 4.4.0-1003.3
- linux-goldfish< 3.4.0-4.27
Redhat4 products
Linux2 products
- kernel:2.6.22.17
- linux_kernel< 2.6.22.17
3 vendors · 17 products
References
9 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2634X Refsource CONFIRMIssue TrackingPatchThird Party Advisory