PT-2017-19169 · Gnu+1 · Gnu Grub+1

Published 2017-06-19 · Updated 2021-03-02 · CVE-2017-9763

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNU GRUB versions prior to 2013-11-12

Description The issue allows remote attackers to cause a denial of service, leading to excessive stack use and application crash, via a crafted binary file. This is related to the use of a variable-size stack array in the grub ext2 read block function.

Recommendations For GNU GRUB versions prior to 2013-11-12, update to a version released after 2013-11-12 to resolve the issue.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-9763

SUSE-SU-2019:13989-1

SUSE-SU-2019_13989-1

SUSE-SU-2021:14659-1

SUSE-SU-2021_14659-1

Affected Products

Gnu Grub

Suse

References · 53

• 🔥 https://github.com/kukrimate/CVE-2020-14372 · Exploit
• https://github.com/radare/radare2/issues/7723 · Patch
• https://github.com/radare/radare2/commit/65000a7fd9eea62359e6d6714f17b94a99a82edd · Patch
• https://bdu.fstec.ru/vul/2022-00338 · Security Note
• http://git.savannah.gnu.org/cgit/grub.git/commit/grub-core/fs/ext2.c?id=ac8cac1dac50daaf1c390d701cca3b55e16ee768 · Patch
• https://bdu.fstec.ru/vul/2022-00308 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-9763 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/685432 · Security Note
• https://bdu.fstec.ru/vul/2022-00337 · Security Note
• https://bdu.fstec.ru/vul/2022-00326 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9763 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00313 · Security Note
• https://bdu.fstec.ru/vul/2022-00304 · Security Note
• https://bdu.fstec.ru/vul/2022-00341 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-9763 · Security Note