PT-2017-1997 · Linux+4 · Linux Kernel+4

Ari Kauppi + 1 · Published 2017-04-25 · Updated 2023-01-19 · CVE-2017-7895

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.10.13

Description The issue is related to an integer overflow in the NFSv2 and NFSv3 server implementations. It may allow a remote attacker to trigger pointer-arithmetic errors or have other unspecified impacts by sending specially crafted requests. The affected files are fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.

Recommendations For Linux kernel versions prior to 4.10.13, update to version 4.10.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the NFSv2 and NFSv3 server implementations until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-189

Related Identifiers

ALT-PU-2017-1600

ALT-PU-2017-1601

BDU:2017-01162

CESA-2017_1615

CESA-2017_1723

CVE-2017-7895

DLA-993-1

DSA-3886-1

MGASA-2017-0147

MGASA-2017-0148

RHSA-2017:1615

RHSA-2017:1616

RHSA-2017:1647

RHSA-2017:1715

RHSA-2017:1723

RHSA-2017:1766

RHSA-2017:1798

RHSA-2017:2412

RHSA-2017:2428

RHSA-2017:2429

RHSA-2017:2472

RHSA-2017:2732

RHSA-2017_1615

RHSA-2017_1616

RHSA-2017_1723

RHSA-2017_2412

USN-3312-1

USN-3312-2

USN-3314-1

USN-3359-1

USN-3360-1

USN-3360-2

USN-3361-1

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Ubuntu

References · 132

• https://github.com/torvalds/linux/commit/13bf9fbff0e5e099e2b6f003a0ab8ae145436309 · Patch
• https://access.redhat.com/errata/RHSA-2017:1798 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5551 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8955 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8636 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13bf9fbff0e5e099e2b6f003a0ab8ae145436309 · Patch
• https://access.redhat.com/errata/RHSA-2017:1616 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1766 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2429 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2017-1615.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8632 · Vendor Advisory
• http://debian.org/security/2017/dsa-3886 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-0605 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1615 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7895 · Security Note