CVE-2017-7187: linux linux_kernel

Vulnerability summary

CVE-2017-7187 is a high (CVSS 7.8) vulnerability in linux linux_kernel. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.3% of scored vulnerabilities.

Timeline

1. 20-03-2017
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.