PT-2018-6613 · Arista+7 · Veos+7

Published

2017-07-06

·

Updated

2025-01-03

·

CVE-2017-18017

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.11 Linux kernel versions 4.9.x prior to 4.9.36
Description: The issue is related to the tcpmss mangle packet function in the Linux kernel, which allows remote attackers to cause a denial of service or possibly have other impacts by leveraging the presence of xt TCPMSS in an iptables action. This can lead to a use-after-free and memory corruption. In the context of Arista's vEOS router software, this vulnerability can cause the instance to crash and potentially allow arbitrary code execution when iptables rules with TCPMSS action are configured.
Recommendations: For Linux kernel versions prior to 4.11, update to version 4.11 or later. For Linux kernel versions 4.9.x prior to 4.9.36, update to version 4.9.36 or later. As a temporary workaround, consider disabling the tcpmss mangle packet function until a patch is available. Restrict access to the xt TCPMSS module to minimize the risk of exploitation.

Exploit

Fix

DoS

Use After Free

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALT-PU-2017-1817
ALT-PU-2017-1854
CESA-2018_1062
CESA-2018_1319
CVE-2017-18017
DLA-1369-1
DSA-4187-1
OPENSUSE-SU-2018_0408-1
RHSA-2018:0676
RHSA-2018:1062
RHSA-2018:1130
RHSA-2018:1170
RHSA-2018:1319
RHSA-2018:1737
RHSA-2018_0676
RHSA-2018_1062
RHSA-2018_1319
SUSE-SU-2018:0383-1
SUSE-SU-2018:0416-1
SUSE-SU-2018:0482-1
SUSE-SU-2018:0555-1
SUSE-SU-2018:0660-1
SUSE-SU-2018:0834-1
SUSE-SU-2018:0841-1
SUSE-SU-2018:0848-1
SUSE-SU-2018:0986-1
USN-3583-1
USN-3583-2

Affected Products

Alt Linux
Centos
Linux Kernel
Red Hat
Suse
Ubuntu
Iptables
Veos