CVE-2017-5123: linux linux_kernel Improper Input Validation
Vulnerability summary
CVE-2017-5123 is a high (CVSS 8.8) Improper Input Validation vulnerability in linux linux_kernel. EPSS estimates a 3.74% chance of exploitation in the next 30 days, higher than 89.8% of scored vulnerabilities. 2 public exploits are recorded.
Public exploit (exploit-database, 06-11-2017)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 02-11-2021PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Insufficient data validation in waitid allowed an user to escape sandboxes on Linux.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
3.74%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
Increase +0.03 pp
From 3.71% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundLinux Kernel 4.13 (Ubuntu 17.10) - 'waitid()' SMEP/SMAP/Chrome Sandbox Privilege Escalation
Maturity: poc
Linux Kernel 4.14.0-rc4+ - 'waitid()' Local Privilege Escalation
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu4 products
- linux-azure< 4.15.0-1023.24~14.04.1 | < 4.13.0-1005.7
- linux-gcp< 4.13.0-1002.5
- linux-hwe< 4.13.0-26.29~16.04.2
- linux-oem< 4.13.0-1008.9
Debian1 product
- linux< 4.13.4-2
Linux1 product
- linux_kernel≥ 4.13, < 4.13.7
4 vendors · 14 products
