PT-2017-2371 · Linux+3 · Linux Kernel+3

Published 2017-04-09 · Updated 2023-02-14 · CVE-2017-7618

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 4.10.9

Description The issue is related to the crypto/ahash.c component in the Linux kernel, which can lead to a denial of service due to infinite recursion. This occurs when an attacker triggers EBUSY on a full queue, causing the API operation to call its own callback.

Recommendations For Linux kernel versions through 4.10.9, update to a version later than 4.10.9 to resolve the issue.

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

ALT-PU-2017-1507

ALT-PU-2017-1508

BDU:2017-01571

CVE-2017-7618

DLA-922-1

OPENSUSE-SU-2017_1140-1

OPENSUSE-SU-2017_1215-1

SUSE-SU-2017:1853-1

SUSE-SU-2017:1990-1

USN-3312-1

USN-3312-2

USN-3314-1

USN-3361-1

Affected Products

Alt Linux

Linux Kernel

Suse

Ubuntu

References · 452

• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7618 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-2671 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5550 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6214 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6001 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5970 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-8924 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3361-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7645 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3312-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5546 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7618 · Security Note
• https://ubuntu.com/security/CVE-2017-7261 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6346 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-7618 · Security Note