7.5

CVE-2017-7558: debian debian_linux Out-of-bounds Read

CVSS: 7.5v3.0HighModified
AliasesUBUNTU-CVE-2017-7558DEBIAN-CVE-2017-7558
Published 26-07-2018Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2017-7558 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in debian debian_linux. EPSS estimates a 3.62% chance of exploitation in the next 30 days, higher than 89.3% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.0 (NVD)
EPSS score
3.62%
0%100%
Low · -0.15 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6
MGASA-2017-0381MGASA-2017-0383MGASA-2017-0384RHSA-2017:2918RHSA-2017:2930RHSA-2017:2931

Timeline

  1. 26-07-2018
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() functions present since version 4.7-rc1 through version 4.13. A data leak happens when these functions fill in sockaddr data structures used to export socket's diagnostic information. As a result, up to 100 bytes of the slab data could be leaked to a userspace.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

3.62%

Chance of exploitation in the next 30 days

Percentile

89%

Versus all other CVEs

30-day change

-0.15 pp

From 3.76% on 18-09-2026

18-09-202618-10-2026
EPSS score
3.62%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu12 products
  • linux-azure< 4.13.0-1005.7 | All versions (No fix recorded)
  • linux-azure-fdeAll versions (No fix recorded)
  • linux-gcp< 4.13.0-1002.5 | All versions (No fix recorded)
  • linux-gkeAll versions (No fix recorded)
  • linux-hwe< 4.13.0-32.35~16.04.1 | All versions (No fix recorded)
Debian2 products
Linux2 products
  • kernel4.7-rc1 through 4.13
  • linux_kernel≥ 4.7, ≤ 4.13 | 4.7:rc1 | 4.7:rc2 | 4.7:rc3 | 4.7:rc4 | 4.7:rc5 | 4.7:rc6 | 4.7:rc7

3 vendors · 16 products

References

13 links
Show all 13 references