{"id":"CVE-2017-17863","aliases":["DEBIAN-CVE-2017-17863","DSA-4073-1","EUVD-2017-9010","GHSA-55f7-p7jv-3448","MGASA-2018-0062","MGASA-2018-0063","MGASA-2018-0064"],"status":"published","title":"kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship...","description":"kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship between pointer values and the BPF stack, which allows local users to cause a denial of service (integer overflow or invalid memory access) or possibly have unspecified other impact.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00409,"percentile":0.35422,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2017-12-23T00:00:00Z","modified":"2026-09-01T20:03:45Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.14.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.14.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.14.7-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.7-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.65-3+deb9u1"}]}],"versions":["4.9.30-2","4.9.30-2+deb9u1","4.9.30-2+deb9u2","4.9.30-2+deb9u2~bpo8+1","4.9.30-2+deb9u3","4.9.30-2+deb9u4","4.9.30-2+deb9u5","4.9.30-2+deb9u5~bpo8+1","4.9.47-1","4.9.51-1","4.9.51-1~bpo8+1","4.9.65-1","4.9.65-2","4.9.65-3","4.9.65-3+deb9u1~bpo8+1","4.9.65-3~bpo8+1"],"bundled":18},{"source":"osv","ecosystem":"Mageia:6","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.10-1.mga6"}]}],"bundled":26},{"source":"osv","ecosystem":"Mageia:6","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.10-1.mga6"}]}],"bundled":26},{"source":"osv","ecosystem":"Mageia:6","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-5.mga6"}]}],"bundled":26},{"source":"osv","ecosystem":"Mageia:6","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-5.mga6"}]}],"bundled":26},{"source":"osv","ecosystem":"Mageia:6","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-8.mga6"}]}],"bundled":26},{"source":"osv","ecosystem":"Mageia:6","package":"wireguard-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20171221-1.mga6"}]}],"bundled":26},{"source":"osv","ecosystem":"Mageia:6","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.10-1.mga6"}]}],"bundled":26},{"source":"osv","ecosystem":"Mageia:6","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.10-1.mga6"}]}],"bundled":25}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://www.securitytracker.com/id/1040058","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://usn.ubuntu.com/3523-3/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://www.spinics.net/lists/stable/msg206985.html","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","fix"]},{"url":"http://www.securityfocus.com/bid/102321","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.debian.org/security/2017/dsa-4073","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/usn/usn-3523-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://anonscm.debian.org/cgit/kernel/linux.git/tree/debian/patches/bugfix/all/bpf-reject-out-of-bounds-stack-pointer-calculation.patch?h=stretch-security","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-17863"},{"url":"https://usn.ubuntu.com/3523-3"},{"url":"https://usn.ubuntu.com/usn/usn-3523-2"},{"url":"https://github.com/advisories/GHSA-55f7-p7jv-3448"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-17863","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0062.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22166","tags":["report"]},{"url":"https://kernelnewbies.org/Linux_4.10","tags":["web"]},{"url":"https://kernelnewbies.org/Linux_4.11","tags":["web"]},{"url":"https://kernelnewbies.org/Linux_4.12","tags":["web"]},{"url":"https://kernelnewbies.org/Linux_4.13","tags":["web"]},{"url":"https://kernelnewbies.org/Linux_4.14","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.1","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.2","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.3","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.4","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.5","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.6","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.7","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.8","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.9","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.10","tags":["web"]},{"url":"https://www.wireguard.com/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0063.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22268","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2018-0064.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22269","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-17863","description":"kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship between pointer values and the BPF stack, which allows local users to cause a denial of service (integer overflow or invalid memory access) or possibly have unspecified other impact.","status":"published","published":"2017-12-23T17:00:00Z","modified":"2024-08-05T21:06:48.911Z","updated_at":"2026-11-02T14:33:17.903346Z"}],"euvd":[{"id":"EUVD-2017-9010","description":"kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship between pointer values and the BPF stack, which allows local users to cause a denial of service (integer overflow or invalid memory access) or possibly have unspecified other impact.","status":"published","published":"2017-12-23T17:00:00Z","modified":"2024-08-05T21:06:48Z","updated_at":"2026-11-03T02:23:08.488418Z"}],"ghsa":[{"id":"GHSA-55f7-p7jv-3448","title":"kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship...","description":"kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship between pointer values and the BPF stack, which allows local users to cause a denial of service (integer overflow or invalid memory access) or possibly have unspecified other impact.","status":"published","published":"2022-05-14T03:37:36Z","modified":"2025-04-20T03:50:30Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:01:56.679657Z"}],"nvd":[{"id":"CVE-2017-17863","description":"kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship between pointer values and the BPF stack, which allows local users to cause a denial of service (integer overflow or invalid memory access) or possibly have unspecified other impact.","status":"published","published":"2017-12-27T17:08:20.483Z","modified":"2026-06-17T01:11:47.623Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:04:11.215487Z"}],"osv":[{"id":"CVE-2017-17863","description":"kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship between pointer values and the BPF stack, which allows local users to cause a denial of service (integer overflow or invalid memory access) or possibly have unspecified other impact.","status":"published","published":"2017-12-27T17:08:20.483Z","modified":"2026-04-16T06:24:49.877575058Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-17863","description":"kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship between pointer values and the BPF stack, which allows local users to cause a denial of service (integer overflow or invalid memory access) or possibly have unspecified other impact.","status":"published","published":"2017-12-27T17:08:20.483Z","modified":"2026-09-01T20:03:45.906156096Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"DSA-4073-1","title":"linux - security update","status":"published","published":"2017-12-23T00:00:00Z","modified":"2026-03-09T01:22:10.986473Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2018-0062","title":"kernel update provides 4.14 series and fixes security vulnerabilities","description":"This kernel update provides an upgrade to the 4.14 longterm branch,\ncurrently based on 4.14.10. It also fixes at least the following\nsecurity issues:\n\nAn elevation of privilege vulnerability in the Broadcom wi-fi driver\n(CVE-2017-0786).\n\nUse-after-free vulnerability in the snd_pcm_info function in the ALSA\nsubsystem in the Linux kernel allows attackers to gain privileges via\nunspecified vectors (CVE-2017-0861).\n\nLinux kernel built with the Kernel-based Virtual Machine(CONFIG_KVM)\nsupport is vulnerable to an incorrect debug exception(#DB) error. It\ncould occur while emulating a syscall instruction. A user/process\ninside guest could use this flaw to potentially escalate their\nprivileges inside guest. Linux guests are not affected.(CVE-2017-7518).\n\narch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested\nvirtualisation is used, does not properly traverse guest pagetable\nentries to resolve a guest virtual address, which allows L1 guest OS\nusers to execute arbitrary code on the host OS or cause a denial of\nservice (incorrect index during page walking, and host OS crash), aka\nan \"MMU potential stack buffer overrun\" (CVE-2017-12188).\n\nThe bio_map_user_iov and bio_unmap_user functions in block/bio.c in the\nLinux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O\nvector has small consecutive buffers belonging to the same page. The\nbio_add_pc_page function merges them into one, but the page reference\nis never dropped. This causes a memory leak and possible system lockup\n(exploitable against the host OS by a guest OS user, if a SCSI disk is\npassed through to a virtual machine) due to an out-of-memory condition\n(CVE-2017-12190).\n\nThe assoc_array_insert_into_terminal_node function in lib/assoc_array.c\nin the Linux kernel before 4.13.11 mishandles node splitting, which allows\nlocal users to cause a denial of service (NULL pointer dereference and\npanic) via a crafted application, as demonstrated by the keyring key type,\nand key addition and link creation operations (CVE-2017-12193).\n\nWi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group\nTemporal Key (GTK) during the group key handshake, allowing an attacker\nwithin radio range to replay frames from access points to clients\n(CVE-2017-13080).\n\nThe sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel\nbefore 4.14 does not check whether the intended netns is used in a\npeel-off action, which allows local users to cause a denial of\nservice (use-after-free and system crash) or possibly have unspecified\nother impact via crafted system calls (CVE-2017-15115).\n\nRace condition in the ALSA subsystem in the Linux kernel before 4.13.8\nallows local users to cause a denial of service (use-after-free) or\npossibly have unspecified other impact via crafted /dev/snd/seq ioctl\ncalls, related to sound/core/seq/seq_clientmgr.c and \nsound/core/seq/seq_ports.c (CVE-2017-15265)\n\nThe KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of\nadd_key for a key that already exists but is uninstantiated, which allows\nlocal users to cause a denial of service (NULL pointer dereference and\nsystem crash) or possibly have unspecified other impact via a crafted\nsystem call (CVE-2017-15299).\n\nThe XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux\nkernel before 4.13.11 allows local users to gain privileges or cause a\ndenial of service (use-after-free) via a crafted SO_RCVBUF setsockopt\nsystem call in conjunction with XFRM_MSG_GETPOLICY Netlink messages\n(CVE-2017-16939).\n\nThe walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel\nbefore 4.14.2 mishandles holes in hugetlb ranges, which allows local\nusers to obtain sensitive information from uninitialized kernel memory\nvia crafted use of the mincore() system call (CVE-2017-16994).\n\nThe check_alu_op function in kernel/bpf/verifier.c in the Linux kernel\nthrough 4.14.8 allows local users to cause a denial of service (memory\ncorruption) or possibly have unspecified other impact by leveraging\nincorrect sign extension (CVE-2017-16995).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local\nusers to cause a denial of service (memory corruption) or possibly have\nunspecified other impact by leveraging register truncation mishandling\n(CVE-2017-16996).\n\nThe KVM implementation in the Linux kernel through 4.14.7 allows attackers\nto obtain potentially sensitive information from kernel memory, aka a\nwrite_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c\nand include/trace/events/kvm.h (CVE-2017-17741).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local\nusers to cause a denial of service (memory corruption) or possibly have\nunspecified other impact by leveraging mishandling of 32-bit ALU ops\n(CVE-2017-17852).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local\nusers to cause a denial of service (memory corruption) or possibly have\nunspecified other impact by leveraging incorrect BPF_RSH signed bounds\ncalculations (CVE-2017-17853).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local\nusers to cause a denial of service (integer overflow and memory\ncorruption) or possibly have unspecified other impact by leveraging\nunrestricted integer values for pointer arithmetic (CVE-2017-17854).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local\nusers to cause a denial of service (memory corruption) or possibly have\nunspecified other impact by leveraging improper use of pointers in\nplace of scalars (CVE-2017-17855).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local\nusers to cause a denial of service (memory corruption) or possibly\nhave unspecified other impact by leveraging the lack of stack-pointer\nalignment enforcement (CVE-2017-17856).\n\nThe check_stack_boundary function in kernel/bpf/verifier.c in the Linux\nkernel through 4.14.8 allows local users to cause a denial of service\n(memory corruption) or possibly have unspecified other impact by\nleveraging mishandling of invalid variable stack read operations\n(CVE-2017-17857).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores\nunreachable code, even though it would still be processed by JIT\ncompilers. This behavior, also considered an improper branch-pruning\nlogic issue, could possibly be used by local users for denial of\nservice (CVE-2017-17862).\n\nkernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not\ncheck the relationship between pointer values and the BPF stack, which\nallows local users to cause a denial of service (integer overflow or\ninvalid memory access) or possibly have unspecified other impact\n(CVE-2017-17863).\n\nkernel/bpf/verifier.c in the Linux kernel before 4.14 mishandles\nstates_equal comparisons between the pointer data type and the\nUNKNOWN_VALUE data type, which allows local users to obtain potentially\nsensitive address information, aka a \"pointer leak\" (CVE-2017-17864).\n\nThe timer_create syscall implementation in kernel/time/posix-timers.c\nin the Linux kernel before 4.14.8 doesn't properly validate the\nsigevent-\u003esigev_notify field, which leads to out-of-bounds access in\nthe show_timer function (called when /proc/$PID/timers is read).\nThis allows userspace applications to read arbitrary kernel memory\n(on a kernel built with CONFIG_POSIX_TIMERS and\nCONFIG_CHECKPOINT_RESTORE)(CVE-2017-18344).\n\nThe Linux Kernel 2.6.32 and later are affected by a denial of service,\nby flooding the diagnostic port 0x80 an exception can be triggered\nleading to a kernel panic (CVE-2017-1000407).\n\nThis update also adds support for WireGuard VPN.\n\nFor other changes in this update, read the referenced changelogs.\n","status":"published","published":"2018-01-06T00:53:31Z","modified":"2026-04-16T06:26:17.325590936Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"MGASA-2018-0063","title":"kernel-tmb update provides 4.14 series and fixes security vulnerabilities","description":"This kernel-tmb update provides an upgrade to the 4.14 longterm branch,\ncurrently based on 4.14.10. It also fixes at least the following\nsecurity issues:\n\nAn elevation of privilege vulnerability in the Broadcom wi-fi driver\n(CVE-2017-0786).\n\nUse-after-free vulnerability in the snd_pcm_info function in the ALSA\nsubsystem in the Linux kernel allows attackers to gain privileges via\nunspecified vectors (CVE-2017-0861).\n\nLinux kernel built with the Kernel-based Virtual Machine(CONFIG_KVM)\nsupport is vulnerable to an incorrect debug exception(#DB) error. It\ncould occur while emulating a syscall instruction. A user/process\ninside guest could use this flaw to potentially escalate their\nprivileges inside guest. Linux guests are not affected.(CVE-2017-7518).\n\narch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested\nvirtualisation is used, does not properly traverse guest pagetable\nentries to resolve a guest virtual address, which allows L1 guest OS\nusers to execute arbitrary code on the host OS or cause a denial of\nservice (incorrect index during page walking, and host OS crash), aka\nan \"MMU potential stack buffer overrun\" (CVE-2017-12188).\n\nThe bio_map_user_iov and bio_unmap_user functions in block/bio.c in the\nLinux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O\nvector has small consecutive buffers belonging to the same page. The\nbio_add_pc_page function merges them into one, but the page reference\nis never dropped. This causes a memory leak and possible system lockup\n(exploitable against the host OS by a guest OS user, if a SCSI disk is\npassed through to a virtual machine) due to an out-of-memory condition\n(CVE-2017-12190).\n\nThe assoc_array_insert_into_terminal_node function in lib/assoc_array.c\nin the Linux kernel before 4.13.11 mishandles node splitting, which allows\nlocal users to cause a denial of service (NULL pointer dereference and\npanic) via a crafted application, as demonstrated by the keyring key type,\nand key addition and link creation operations (CVE-2017-12193).\n\nWi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group\nTemporal Key (GTK) during the group key handshake, allowing an attacker\nwithin radio range to replay frames from access points to clients\n(CVE-2017-13080).\n\nThe sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel\nbefore 4.14 does not check whether the intended netns is used in a\npeel-off action, which allows local users to cause a denial of\nservice (use-after-free and system crash) or possibly have unspecified\nother impact via crafted system calls (CVE-2017-15115).\n\nRace condition in the ALSA subsystem in the Linux kernel before 4.13.8\nallows local users to cause a denial of service (use-after-free) or\npossibly have unspecified other impact via crafted /dev/snd/seq ioctl\ncalls, related to sound/core/seq/seq_clientmgr.c and \nsound/core/seq/seq_ports.c (CVE-2017-15265)\n\nThe KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of\nadd_key for a key that already exists but is uninstantiated, which allows\nlocal users to cause a denial of service (NULL pointer dereference and\nsystem crash) or possibly have unspecified other impact via a crafted\nsystem call (CVE-2017-15299).\n\nThe XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux\nkernel before 4.13.11 allows local users to gain privileges or cause a\ndenial of service (use-after-free) via a crafted SO_RCVBUF setsockopt\nsystem call in conjunction with XFRM_MSG_GETPOLICY Netlink messages\n(CVE-2017-16939).\n\nThe walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel\nbefore 4.14.2 mishandles holes in hugetlb ranges, which allows local\nusers to obtain sensitive information from uninitialized kernel memory\nvia crafted use of the mincore() system call (CVE-2017-16994).\n\nThe check_alu_op function in kernel/bpf/verifier.c in the Linux kernel\nthrough 4.14.8 allows local users to cause a denial of service (memory\ncorruption) or possibly have unspecified other impact by leveraging\nincorrect sign extension (CVE-2017-16995).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local\nusers to cause a denial of service (memory corruption) or possibly have\nunspecified other impact by leveraging register truncation mishandling\n(CVE-2017-16996).\n\nThe KVM implementation in the Linux kernel through 4.14.7 allows attackers\nto obtain potentially sensitive information from kernel memory, aka a\nwrite_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c\nand include/trace/events/kvm.h (CVE-2017-17741).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local\nusers to cause a denial of service (memory corruption) or possibly have\nunspecified other impact by leveraging mishandling of 32-bit ALU ops\n(CVE-2017-17852).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local\nusers to cause a denial of service (memory corruption) or possibly have\nunspecified other impact by leveraging incorrect BPF_RSH signed bounds\ncalculations (CVE-2017-17853).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local\nusers to cause a denial of service (integer overflow and memory\ncorruption) or possibly have unspecified other impact by leveraging\nunrestricted integer values for pointer arithmetic (CVE-2017-17854).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local\nusers to cause a denial of service (memory corruption) or possibly have\nunspecified other impact by leveraging improper use of pointers in\nplace of scalars (CVE-2017-17855).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local\nusers to cause a denial of service (memory corruption) or possibly\nhave unspecified other impact by leveraging the lack of stack-pointer\nalignment enforcement (CVE-2017-17856).\n\nThe check_stack_boundary function in kernel/bpf/verifier.c in the Linux\nkernel through 4.14.8 allows local users to cause a denial of service\n(memory corruption) or possibly have unspecified other impact by\nleveraging mishandling of invalid variable stack read operations\n(CVE-2017-17857).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores\nunreachable code, even though it would still be processed by JIT\ncompilers. This behavior, also considered an improper branch-pruning\nlogic issue, could possibly be used by local users for denial of\nservice (CVE-2017-17862).\n\nkernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not\ncheck the relationship between pointer values and the BPF stack, which\nallows local users to cause a denial of service (integer overflow or\ninvalid memory access) or possibly have unspecified other impact\n(CVE-2017-17863).\n\nkernel/bpf/verifier.c in the Linux kernel before 4.14 mishandles\nstates_equal comparisons between the pointer data type and the\nUNKNOWN_VALUE data type, which allows local users to obtain potentially\nsensitive address information, aka a \"pointer leak\" (CVE-2017-17864).\n\nThe timer_create syscall implementation in kernel/time/posix-timers.c\nin the Linux kernel before 4.14.8 doesn't properly validate the\nsigevent-\u003esigev_notify field, which leads to out-of-bounds access in\nthe show_timer function (called when /proc/$PID/timers is read).\nThis allows userspace applications to read arbitrary kernel memory\n(on a kernel built with CONFIG_POSIX_TIMERS and\nCONFIG_CHECKPOINT_RESTORE)(CVE-2017-18344).\n\nThe Linux Kernel 2.6.32 and later are affected by a denial of service,\nby flooding the diagnostic port 0x80 an exception can be triggered\nleading to a kernel panic (CVE-2017-1000407).\n\nThis update also adds support for WireGuard VPN.\n\nFor other changes in this update, read the referenced changelogs.\n","status":"published","published":"2018-01-06T00:53:31Z","modified":"2026-04-16T06:22:43.462881638Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"MGASA-2018-0064","title":"kernel-linus update provides 4.14 series and fixes security vulnerabilities","description":"This kernel-linus update provides an upgrade to the 4.14 longterm\nbranch, currently based on 4.14.10. It also fixes at least the\nfollowing security issues:\n\nAn elevation of privilege vulnerability in the Broadcom wi-fi driver\n(CVE-2017-0786).\n\nUse-after-free vulnerability in the snd_pcm_info function in the ALSA\nsubsystem in the Linux kernel allows attackers to gain privileges via\nunspecified vectors (CVE-2017-0861).\n\nLinux kernel built with the Kernel-based Virtual Machine(CONFIG_KVM)\nsupport is vulnerable to an incorrect debug exception(#DB) error. It\ncould occur while emulating a syscall instruction. A user/process\ninside guest could use this flaw to potentially escalate their\nprivileges inside guest. Linux guests are not affected.(CVE-2017-7518).\n\narch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested\nvirtualisation is used, does not properly traverse guest pagetable\nentries to resolve a guest virtual address, which allows L1 guest OS\nusers to execute arbitrary code on the host OS or cause a denial of\nservice (incorrect index during page walking, and host OS crash), aka\nan \"MMU potential stack buffer overrun\" (CVE-2017-12188).\n\nThe bio_map_user_iov and bio_unmap_user functions in block/bio.c in the\nLinux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O\nvector has small consecutive buffers belonging to the same page. The\nbio_add_pc_page function merges them into one, but the page reference\nis never dropped. This causes a memory leak and possible system lockup\n(exploitable against the host OS by a guest OS user, if a SCSI disk is\npassed through to a virtual machine) due to an out-of-memory condition\n(CVE-2017-12190).\n\nThe assoc_array_insert_into_terminal_node function in lib/assoc_array.c\nin the Linux kernel before 4.13.11 mishandles node splitting, which allows\nlocal users to cause a denial of service (NULL pointer dereference and\npanic) via a crafted application, as demonstrated by the keyring key type,\nand key addition and link creation operations (CVE-2017-12193).\n\nWi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group\nTemporal Key (GTK) during the group key handshake, allowing an attacker\nwithin radio range to replay frames from access points to clients\n(CVE-2017-13080).\n\nThe sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel\nbefore 4.14 does not check whether the intended netns is used in a\npeel-off action, which allows local users to cause a denial of\nservice (use-after-free and system crash) or possibly have unspecified\nother impact via crafted system calls (CVE-2017-15115).\n\nRace condition in the ALSA subsystem in the Linux kernel before 4.13.8\nallows local users to cause a denial of service (use-after-free) or\npossibly have unspecified other impact via crafted /dev/snd/seq ioctl\ncalls, related to sound/core/seq/seq_clientmgr.c and \nsound/core/seq/seq_ports.c (CVE-2017-15265)\n\nThe KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of\nadd_key for a key that already exists but is uninstantiated, which allows\nlocal users to cause a denial of service (NULL pointer dereference and\nsystem crash) or possibly have unspecified other impact via a crafted\nsystem call (CVE-2017-15299).\n\nThe XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux\nkernel before 4.13.11 allows local users to gain privileges or cause a\ndenial of service (use-after-free) via a crafted SO_RCVBUF setsockopt\nsystem call in conjunction with XFRM_MSG_GETPOLICY Netlink messages\n(CVE-2017-16939).\n\nThe walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel\nbefore 4.14.2 mishandles holes in hugetlb ranges, which allows local\nusers to obtain sensitive information from uninitialized kernel memory\nvia crafted use of the mincore() system call (CVE-2017-16994).\n\nThe check_alu_op function in kernel/bpf/verifier.c in the Linux kernel\nthrough 4.14.8 allows local users to cause a denial of service (memory\ncorruption) or possibly have unspecified other impact by leveraging\nincorrect sign extension (CVE-2017-16995).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local\nusers to cause a denial of service (memory corruption) or possibly have\nunspecified other impact by leveraging register truncation mishandling\n(CVE-2017-16996).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local\nusers to cause a denial of service (memory corruption) or possibly have\nunspecified other impact by leveraging mishandling of 32-bit ALU ops\n(CVE-2017-17852).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local\nusers to cause a denial of service (memory corruption) or possibly have\nunspecified other impact by leveraging incorrect BPF_RSH signed bounds\ncalculations (CVE-2017-17853).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local\nusers to cause a denial of service (integer overflow and memory\ncorruption) or possibly have unspecified other impact by leveraging\nunrestricted integer values for pointer arithmetic (CVE-2017-17854).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local\nusers to cause a denial of service (memory corruption) or possibly have\nunspecified other impact by leveraging improper use of pointers in\nplace of scalars (CVE-2017-17855).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local\nusers to cause a denial of service (memory corruption) or possibly\nhave unspecified other impact by leveraging the lack of stack-pointer\nalignment enforcement (CVE-2017-17856).\n\nThe check_stack_boundary function in kernel/bpf/verifier.c in the Linux\nkernel through 4.14.8 allows local users to cause a denial of service\n(memory corruption) or possibly have unspecified other impact by\nleveraging mishandling of invalid variable stack read operations\n(CVE-2017-17857).\n\nkernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores\nunreachable code, even though it would still be processed by JIT\ncompilers. This behavior, also considered an improper branch-pruning\nlogic issue, could possibly be used by local users for denial of\nservice (CVE-2017-17862).\n\nkernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not\ncheck the relationship between pointer values and the BPF stack, which\nallows local users to cause a denial of service (integer overflow or\ninvalid memory access) or possibly have unspecified other impact\n(CVE-2017-17863).\n\nkernel/bpf/verifier.c in the Linux kernel before 4.14 mishandles\nstates_equal comparisons between the pointer data type and the\nUNKNOWN_VALUE data type, which allows local users to obtain potentially\nsensitive address information, aka a \"pointer leak\" (CVE-2017-17864).\n\nThe timer_create syscall implementation in kernel/time/posix-timers.c\nin the Linux kernel before 4.14.8 doesn't properly validate the\nsigevent-\u003esigev_notify field, which leads to out-of-bounds access in\nthe show_timer function (called when /proc/$PID/timers is read).\nThis allows userspace applications to read arbitrary kernel memory\n(on a kernel built with CONFIG_POSIX_TIMERS and\nCONFIG_CHECKPOINT_RESTORE)(CVE-2017-18344).\n\nThe Linux Kernel 2.6.32 and later are affected by a denial of service,\nby flooding the diagnostic port 0x80 an exception can be triggered\nleading to a kernel panic (CVE-2017-1000407).\n\nFor other changes in this update, read the referenced changelogs.\n","status":"published","published":"2018-01-06T00:53:31Z","modified":"2026-04-16T06:22:49.505651352Z","updated_at":"2026-11-02T15:49:40.442238Z"}]}}