PT-2017-16950 · Linux+5 · Linux Kernel+5

Dmitry Vyukov

·

Publicado

2017-02-21

·

Atualizado

2019-10-03

·

CVE-2017-6214

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.9.11
Description The issue allows remote attackers to cause a denial of service, resulting in an infinite loop and soft lockup. This can be achieved via vectors involving a TCP packet with the URG flag. The tcp splice read function in net/ipv4/tcp.c is the vulnerable component.
Recommendations For Linux kernel versions prior to 4.9.11, update to version 4.9.11 or later to resolve the issue. As a temporary workaround, consider restricting the handling of TCP packets with the URG flag to minimize the risk of exploitation.

Correção

DoS

Infinite Loop

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

ALT-PU-2017-1193
ALT-PU-2017-1330
CESA-2017_1372
CESA-2017_1615
CVE-2017-6214
DLA-849-1
DSA-3804-1
MGASA-2017-0063
MGASA-2017-0064
MGASA-2017-0065
OPENSUSE-SU-2017_0906-1
OPENSUSE-SU-2017_0907-1
RHSA-2017:1372
RHSA-2017:1615
RHSA-2017:1616
RHSA-2017:1647
RHSA-2017_1372
RHSA-2017_1615
RHSA-2017_1616
SUSE-SU-2017:1183-1
SUSE-SU-2017:1247-1
SUSE-SU-2017:1301-1
SUSE-SU-2017:1360-1
SUSE-SU-2017:1990-1
SUSE-SU-2017:2342-1
SUSE-SU-2017:2525-1
USN-3265-1
USN-3265-2
USN-3361-1
USN-3422-1
USN-3422-2

Produtos afetados

Alt Linux
Centos
Linux Kernel
Red Hat
Suse
Ubuntu