CVE-2017-9461: debian debian_linux Loop with Unreachable Exit Condition
Vulnerability summary
CVE-2017-9461 is a medium (CVSS 6.8) Loop with Unreachable Exit Condition vulnerability in debian debian_linux. EPSS estimates a 4.23% chance of exploitation in the next 30 days, higher than 91% of scored vulnerabilities. 2 public exploits are recorded.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3Timeline
- 06-06-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
4.23%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.23% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (bugzilla.samba.org)
Maturity: unknown
Exploit Reference (bugs.debian.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat33 products
- enterprise_linux_desktop7.0
- enterprise_linux_server7.0
- enterprise_linux_server_aus7.4 | 7.6
- enterprise_linux_server_eus7.4 | 7.5 | 7.6
- enterprise_linux_server_tus7.6
Debian2 products
- samba< 2:4.5.6+dfsg-1
- debian_linuxEOL8.0
Samba1 product
- sambaEOL≤ 4.4.9 | 4.5.0 | 4.5.1 | 4.5.2 | 4.5.3 | 4.5.4 | 4.5.5
Ubuntu1 product
- samba< 2:4.3.11+dfsg-0ubuntu0.14.04.9 | < 2:4.3.11+dfsg-0ubuntu0.16.04.8
4 vendors · 37 products
References
40 links- access.redhat.com/errata/RHSA-2017:1950Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- bugzilla.samba.org/show_bug.cgi?id=12572X Refsource CONFIRMExploitIssue TrackingPatchThird Party AdvisoryVDB Entry
- lists.debian.org/debian-lts-announce/2019/04/msg00013.htmlMailing ListX Refsource MLISTThird Party Advisory
