{"id":"CVE-2017-11171","aliases":["DEBIAN-CVE-2017-11171","EUVD-2017-2806","GHSA-9rpj-3fh9-94x5","SUSE-SU-2017:2173-1"],"status":"published","title":"Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old...","description":"Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00322,"percentile":0.25376,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2017-07-11T20:00:00Z","modified":"2026-10-20T13:16:30Z","fixes":[{"ecosystem":"Debian:12","package":"gnome-session","fixed_in":["2.30.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnome-session","fixed_in":["2.30.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnome-session","fixed_in":["2.30.0-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"gnome-session","fixed_in":["2.28.0-3.11.12.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"gnome-session","fixed_in":["2.28.0-3.11.12.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gnome-session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.30.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gnome-session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.30.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnome-session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.30.0-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"gnome-session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.0-3.11.12.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"gnome-session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.0-3.11.12.2"}]}]}],"products":[{"vendor":"gnome","product":"gnome-session"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1025068","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/GNOME/gnome-session/commit/b0dc999e0b45355314616321dbb6cb71e729fc9d","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11171"},{"url":"https://github.com/advisories/GHSA-9rpj-3fh9-94x5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-11171","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172173-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1048274","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11171","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-11171","description":"Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible.","status":"published","published":"2017-07-11T20:00:00Z","modified":"2024-09-17T03:34:04.882Z","updated_at":"2026-11-02T14:33:19.848632Z"}],"euvd":[{"id":"EUVD-2017-2806","description":"Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible.","status":"published","published":"2017-07-11T20:00:00Z","modified":"2024-09-17T03:34:04Z","updated_at":"2026-11-03T00:28:30.770637Z"}],"ghsa":[{"id":"GHSA-9rpj-3fh9-94x5","title":"Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old...","description":"Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible.","status":"published","published":"2022-05-13T01:42:11Z","modified":"2023-02-02T05:00:48Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:51:02.804004Z"}],"nvd":[{"id":"CVE-2017-11171","description":"Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible.","status":"published","published":"2017-07-11T20:29:00.267Z","modified":"2026-06-17T01:01:20.88Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:03:54.012105Z"}],"osv":[{"id":"CVE-2017-11171","description":"Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible.","status":"published","published":"2017-07-11T20:29:00.267Z","modified":"2026-10-20T13:16:30.695945476Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-11171","description":"Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible.","status":"published","published":"2017-07-11T20:29:00.267Z","modified":"2026-09-01T20:03:41.203913472Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"SUSE-SU-2017:2173-1","title":"Security update for gnome-session","description":"\n\nThis update for gnome-session fixes the following issues:\n\n- CVE-2017-11171: Fix a denial of service condition. an unauthenticated local user\n  can create ICE connections, causing a file descriptor leak in\n  gnome-session (bsc#1048274).\n\n","status":"published","published":"2017-08-16T09:28:45Z","modified":"2026-02-04T03:45:04.399977Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}