PT-2017-1997 · Linux+4 · Linux Kernel+4

Ari Kauppi + 1 · Publicado 2017-04-25 · Atualizado 2023-01-19 · CVE-2017-7895

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.10.13

Description The issue is related to an integer overflow in the NFSv2 and NFSv3 server implementations. It may allow a remote attacker to trigger pointer-arithmetic errors or have other unspecified impacts by sending specially crafted requests. The affected files are fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.

Recommendations For Linux kernel versions prior to 4.10.13, update to version 4.10.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the NFSv2 and NFSv3 server implementations until a patch is available.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

CWE-189

Identificadores relacionados

ALT-PU-2017-1600

ALT-PU-2017-1601

BDU:2017-01162

CESA-2017_1615

CESA-2017_1723

CVE-2017-7895

DLA-993-1

DSA-3886-1

MGASA-2017-0147

MGASA-2017-0148

RHSA-2017:1615

RHSA-2017:1616

RHSA-2017:1647

RHSA-2017:1715

RHSA-2017:1723

RHSA-2017:1766

RHSA-2017:1798

RHSA-2017:2412

RHSA-2017:2428

RHSA-2017:2429

RHSA-2017:2472

RHSA-2017:2732

RHSA-2017_1615

RHSA-2017_1616

RHSA-2017_1723

RHSA-2017_2412

USN-3312-1

USN-3312-2

USN-3314-1

USN-3359-1

USN-3360-1

USN-3360-2

USN-3361-1

Produtos afetados

Alt Linux

Centos

Linux Kernel

Red Hat

Ubuntu

Referências · 132

• https://github.com/torvalds/linux/commit/13bf9fbff0e5e099e2b6f003a0ab8ae145436309 · Correção
• https://access.redhat.com/errata/RHSA-2017:1798 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-5551 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-8955 · Aviso do Fabricante
• https://usn.ubuntu.com/usn/usn-3312-1 · Nota
• http://ubuntu.com/usn/usn-3312-2 · Nota
• https://ubuntu.com/security/CVE-2016-8636 · Aviso do Fabricante
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13bf9fbff0e5e099e2b6f003a0ab8ae145436309 · Correção
• https://access.redhat.com/errata/RHSA-2017:1616 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:1766 · Aviso do Fabricante
• http://ubuntu.com/usn/usn-3360-1 · Nota
• https://access.redhat.com/errata/RHSA-2017:2429 · Aviso do Fabricante
• https://usn.ubuntu.com/usn/usn-3360-1 · Nota
• https://linux.oracle.com/errata/ELSA-2017-1615.html · Aviso do Fabricante
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.65 · Nota