PT-2017-15011 · Linux+5 · Linux Kernel+5

Publicado

2017-12-20

·

Atualizado

2023-01-19

·

CVE-2017-17805

CVSS v3.1

7.8

Alta

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.14.8
Description The Salsa20 encryption algorithm in the Linux kernel does not correctly handle zero-length inputs. This allows a local attacker who can use the AF ALG-based skcipher interface to cause a denial of service, resulting in an uninitialized-memory free and kernel crash, or have unspecified other impact. The issue arises from executing a crafted sequence of system calls that utilize the blkcipher walk API. Both the generic and x86 implementations of Salsa20 are affected.
Recommendations For Linux kernel versions prior to 4.14.8, update to version 4.14.8 or later to resolve the issue.

Correção

DoS

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2017-2818
ALT-PU-2017-2819
CESA-2018_3083
CESA-2019_2473
CVE-2017-17805
DLA-1232-1
DSA-4073-1
DSA-4082-1
OPENSUSE-SU-2018_0022-1
OPENSUSE-SU-2018_0023-1
RHSA-2018:2948
RHSA-2018:3083
RHSA-2018:3096
RHSA-2018_3083
RHSA-2018_3096
RHSA-2019:2473
RHSA-2019_2473
SUSE-SU-2018:0010-1
SUSE-SU-2018:0011-1
SUSE-SU-2018:0012-1
SUSE-SU-2018:0040-1
SUSE-SU-2018:0180-1
SUSE-SU-2018:0213-1
SUSE-SU-2018:0437-1
SUSE-SU-2018:0525-1
USN-3617-1
USN-3617-2
USN-3617-3
USN-3619-1
USN-3619-2
USN-3620-1
USN-3620-2
USN-3632-1

Produtos afetados

Alt Linux
Centos
Linux Kernel
Red Hat
Suse
Ubuntu