CVE-2017-7895

CRITICAL EPSS 95.3%
Published Apr 28, 20179y ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Apr 28, 2017 9y ago
Last Modified Jun 17, 2026 2w ago

Description

The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
95.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Memory Safety

Affected Products 8

VendorProductVersionRange
linuxlinux_kernel* <3.2.89
linuxlinux_kernel*≥3.3  –  <3.16.44
linuxlinux_kernel*≥3.17.0  –  <4.1.40
linuxlinux_kernel*≥4.2  –  <4.4.67
linuxlinux_kernel*≥4.5.0  –  <4.9.26
linuxlinux_kernel*≥4.10  –  <4.10.14
debiandebian_linux8.0any
debiandebian_linux9.0any

References 16

  • debian.org http://www.debian.org/security/2017/dsa-3886
    Third Party Advisory
  • securityfocus.com http://www.securityfocus.com/bid/98085
    Third Party AdvisoryVDB Entry
  • access.redhat.com https://access.redhat.com/errata/RHSA-2017:1615
    Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2017:1616
    Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2017:1647
    Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2017:1715
    Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2017:1723
    Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2017:1766
    Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2017:1798
    Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2017:2412
    Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2017:2428
    Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2017:2429
    Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2017:2472
    Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2017:2732
    Third Party Advisory
  • git.kernel.org https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13bf9fbff0e5e099e2b6f003a0ab8ae145436309
    PatchThird Party Advisory
  • github.com https://github.com/torvalds/linux/commit/13bf9fbff0e5e099e2b6f003a0ab8ae145436309
    PatchThird Party Advisory

Remediation

  • git.kernel.org https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13bf9fbff0e5e099e2b6f003a0ab8ae145436309
    PatchThird Party Advisory
  • github.com https://github.com/torvalds/linux/commit/13bf9fbff0e5e099e2b6f003a0ab8ae145436309
    PatchThird Party Advisory