CVE-2017-9074: linux linux_kernel Out-of-bounds Read
Vulnerability summary
CVE-2017-9074 is a high (CVSS 7.8) Out-of-bounds Read vulnerability in linux linux_kernel. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 36.3% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 20 · Related 11Timeline
- 19-05-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The IPv6 fragmentation implementation in the Linux kernel through 4.11.1 does not consider that the nexthdr field may be associated with an invalid option, which allows local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.42% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu17 products
- linux< 3.13.0-123.172 | < 4.4.0-83.106
- linux-aws< 4.4.0-1022.31
- linux-azure-6.11All versions (No fix recorded)
- linux-azure-fdeAll versions (No fix recorded)
- linux-azure-fde-5.15All versions (No fix recorded)
Debian1 product
- linux< 4.9.30-1
Linux1 product
- linux_kernel< 3.2.89 | ≥ 3.3, < 3.16.44 | ≥ 3.17, < 3.18.56 | ≥ 3.19, < 4.1.42 | ≥ 4.2, < 4.4.71 | ≥ 4.5, < 4.9.31 | ≥ 4.10, < 4.11.4
3 vendors · 19 products
References
21 links- github.com/torvalds/linux/commit/2423496af35d94a87156b063ea5cedffc10a70a1X Refsource CONFIRMPatchVendor AdvisoryREPORT
