CVE-2017-17432
OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote...
OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application crash) via crafted fields, as demonstrated by an integer underflow and assertion failure for a small MTU value.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application crash) via crafted fields, as demonstrated by an integer underflow and assertion failure for a small MTU value.
- Record
CVE-2017-17432- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-617
- Updated
- 2026-11-02
CVE List No score
OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application crash) via crafted fields, as demonstrated by an integer underflow and assertion failure for a small MTU value.
- Record
CVE-2017-17432- Updated
- 2026-11-02
EUVDEUVD-2017-8596 No score
OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application crash) via crafted fields, as demonstrated by an integer underflow and assertion failure for a small MTU value.
- Record
EUVD-2017-8596- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f7jc-5gw7-phrf
OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote...
OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application crash) via crafted fields, as demonstrated by an integer underflow and assertion failure for a small MTU value.
- Record
GHSA-f7jc-5gw7-phrf- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
OSV
OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application crash) via crafted fields, as demonstrated by an integer underflow and assertion failure for a small MTU value.
- Record
CVE-2017-17432- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-17432
OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application crash) via crafted fields, as demonstrated by an integer underflow and assertion failure for a small MTU value.
- Record
DEBIAN-CVE-2017-17432- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-17432
OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application crash) via crafted fields, as demonstrated by an integer underflow and assertion failure for a small MTU value.
- Record
UBUNTU-CVE-2017-17432- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0065 No score
Updated openafs packages fixes security vulnerability
This update provides an update to openafs 1.6.22, fixing the following security issue:
It was discovered that malformed jumbogram packets could result in denial of service against OpenAFS (CVE-2017-17432).
It also adds support for 4.14 series kernels.
- Record
MGASA-2018-0065- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openafsDebian:12 |
before 1.6.22-1 | 1.6.22-1 |
openafsDebian:13 |
before 1.6.22-1 | 1.6.22-1 |
openafsDebian:7 |
before 1.6.1-3+deb7u8, plus listed versions 1.6.1-31.6.1-3+deb7u11.6.1-3+deb7u1~bpo60+11.6.1-3+deb7u21.6.1-3+deb7u2~bpo60+1 Show 5 moreShow less1.6.1-3+deb7u31.6.1-3+deb7u41.6.1-3+deb7u51.6.1-3+deb7u61.6.1-3+deb7u7 |
1.6.1-3+deb7u8 |
openafsDebian:9 |
before 1.6.20-2+deb9u1, plus listed versions 1.6.20-2 |
1.6.20-2+deb9u1 |
openafsDebian:8 |
before 1.6.9-2+deb8u6, plus listed versions 1.6.9-2+deb8u21.6.9-2+deb8u31.6.9-2+deb8u41.6.9-2+deb8u4~bpo70+11.6.9-2+deb8u5 |
1.6.9-2+deb8u6 |
openafsMageia:6 |
before 1.6.22-1.mga6 | 1.6.22-1.mga6 |
openafsUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.14-11.6.15-11.6.15-1ubuntu11.6.15-1ubuntu1.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-17432 is a high vulnerability (CVSS 7.5) in Openafs, published December 6, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.05%, the 87th percentile. Fixed in openafs 1.6.22-1.