PT-2017-4330 · Linux+3 · Linux Kernel+3
Ari Kauppi
·
Published
2017-03-17
·
Updated
2023-02-03
·
CVE-2017-8797
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 4.11.3
Description:
The issue is related to the NFSv4 server in the Linux kernel, which does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This can lead to a denial of service (DoS) of knfsd and a soft-lockup of the whole system. The vulnerability is caused by the lack of validation of user data when handling GETDEVICEINFO and LAYOUTGET operands in UDP packets.
Recommendations:
For Linux kernel versions prior to 4.11.3, update to version 4.11.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the NFSv4 server to minimize the risk of exploitation.
Exploit
Fix
DoS
Improper Validation of Array Index
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Linux Kernel
Red Hat