{"id":"CVE-2017-5548","aliases":["DEBIAN-CVE-2017-5548","EUVD-2017-14649","GHSA-qq52-r2jr-7v6c","MGASA-2017-0063","MGASA-2017-0064","MGASA-2017-0065","UBUNTU-CVE-2017-5548"],"status":"published","title":"drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with...","description":"drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00451,"percentile":0.39423,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2017-02-06T06:04:00Z","modified":"2026-09-01T20:03:48Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.9.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.9.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.9.6-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.6-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.50-2.mga5"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.50-2.mga5"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.10-12.mga5"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.10-12.mga5"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-32.mga5"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.50-2.mga5"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.50-2.mga5"}]}],"bundled":16}],"products":[{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2017/01/21/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.6","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/95710","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1416110","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix"]},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=05a974efa4bdf6e2a150e3f27dc6fcf0a9ad5655","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/torvalds/linux/commit/05a974efa4bdf6e2a150e3f27dc6fcf0a9ad5655","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5548"},{"url":"https://github.com/advisories/GHSA-qq52-r2jr-7v6c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-5548","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0063.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20313","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.40","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.41","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.42","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.43","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.44","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.45","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.46","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.47","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.48","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.49","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.50","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2017-0064.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20314","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2017-0065.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5548","tags":["report"]},{"url":"http://seclists.org/oss-sec/2017/q1/161","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5548","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-5548","description":"drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.","status":"published","published":"2017-02-06T06:04:00Z","modified":"2024-08-05T15:04:15.311Z","updated_at":"2026-11-02T14:33:12.599234Z"}],"euvd":[{"id":"EUVD-2017-14649","description":"drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.","status":"published","published":"2017-02-06T06:04:00Z","modified":"2024-08-05T15:04:15Z","updated_at":"2026-11-03T02:39:15.385305Z"}],"ghsa":[{"id":"GHSA-qq52-r2jr-7v6c","title":"drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with...","description":"drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.","status":"published","published":"2022-05-13T01:46:12Z","modified":"2023-02-02T05:01:28Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:51:11.302625Z"}],"nvd":[{"id":"CVE-2017-5548","description":"drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.","status":"published","published":"2017-02-06T06:59:00.577Z","modified":"2026-06-17T01:20:43.587Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:42.372487Z"}],"osv":[{"id":"CVE-2017-5548","description":"drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.","status":"published","published":"2017-02-06T06:59:00.577Z","modified":"2026-04-16T06:23:08.432431382Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.029968Z"},{"id":"DEBIAN-CVE-2017-5548","description":"drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.","status":"published","published":"2017-02-06T06:59:00.577Z","modified":"2026-09-01T20:03:48.663371859Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"UBUNTU-CVE-2017-5548","description":"drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.","status":"withdrawn","published":"2017-02-06T06:59:00Z","modified":"2025-07-16T08:13:20.334031Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:15.388065Z"},{"id":"MGASA-2017-0063","title":"Updated kernel and kmod packages fixes security vulnerabilities","description":"This kernel update is based on upstream 4.4.50 and fixes at least\nthe following security issues:\n\nThe cgroup offline implementation in the Linux kernel through 4.8.11\nmishandles certain drain operations, which allows local users to cause\na denial of service (system hang) by leveraging access to a container\nenvironment for executing a crafted application, as demonstrated by\ntrinity (CVE-2016-9191).\n\narch/x86/kvm/vmx.c in the Linux kernel through 4.9 mismanages the #BP\nand #OF exceptions, which allows guest OS users to cause a denial of\nservice (guest OS crash) by declining to handle an exception thrown by\nan L2 guest (CVE-2016-9588).\n\nThe sg implementation in the Linux kernel through 4.9 does not properly\nrestrict write operations in situations where the KERNEL_DS option is set,\nwhich allows local users to read or write to arbitrary kernel memory\nlocations or cause a denial of service (use-after-free) by leveraging\naccess to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c\n(CVE-2016-10088).\n\nThe ext4_fill_super function in fs/ext4/super.c in the Linux kernel\nthrough 4.9.8 does not properly validate meta block groups, which\nallows physically proximate attackers to cause a denial of service\n(out-of-bounds read and system crash) via a crafted ext4 image\n(CVE-2016-10208).\n\nThe load_segment_descriptor implementation in arch/x86/kvm/emulate.c in\nthe Linux kernel before 4.9.5 improperly emulates a \"MOV SS, NULL\nselector\" instruction, which allows guest OS users to cause a denial of\nservice (guest OS crash) or gain guest OS privileges via a crafted\napplication (CVE-2017-2583).\n\narch/x86/kvm/emulate.c in the Linux kernel through 4.9.3 allows local\nusers to obtain sensitive information from kernel memory or cause a\ndenial of service (use-after-free) via a crafted application that\nleverages instruction emulation for fxrstor, fxsave, sgdt, and sidt\n(CVE-2017-2584).\n\ndrivers/hid/hid-corsair.c in the Linux kernel 4.9.x before 4.9.6\ninteracts incorrectly with the CONFIG_VMAP_STACK option, which allows\nlocal users to cause a denial of service (system crash or memory\ncorruption) or possibly have unspecified other impact by leveraging\nuse of more than one virtual page for a DMA scatterlist (CVE-2017-5547).\n\ndrivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6\ninteracts incorrectly with the CONFIG_VMAP_STACK option, which allows\nlocal users to cause a denial of service (system crash or memory\ncorruption) or possibly have unspecified other impact by leveraging\nuse of more than one virtual page for a DMA scatterlist (CVE-2017-5548).\n\nThe klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c\nin the Linux kernel before 4.9.5 places uninitialized heap-memory\ncontents into a log entry upon a failure to read the line status, which\nallows local users to obtain sensitive information by reading the log\n(CVE-2017-5549).\n\nThe simple_set_acl function in fs/posix_acl.c in the Linux kernel before\n4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs\nfilesystem, which allows local users to gain group privileges by\nleveraging the existence of a setgid program with restrictions on\nexecute permissions (CVE-2017-5551).\n\nAn issue was found in the Linux kernel ipv6 implementation of GRE tunnels\nwhich allows a remote attacker to trigger an out-of-bounds access\n(CVE-2017-5897).\n\nThe ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux\nkernel through 4.9.9 allows attackers to cause a denial of service\n(system crash) via (1) an application that makes crafted system calls or\npossibly (2) IPv4 traffic with invalid IP options (CVE-2017-5970).\n\nRace condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c\nin the Linux kernel before 4.9.11 allows local users to cause a denial\nof service (assertion failure and panic) via a multithreaded application\nthat peels off an association in a certain buffer-full state\n(CVE-2017-5986).\n\nThe dccp_rcv_state_process function in net/dccp/input.c in the Linux\nkernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures\nin the LISTEN state, which allows local users to obtain root privileges\nor cause a denial of service (double free) via an application that makes\nan IPV6_RECVPKTINFO setsockopt system call (CVE-2017-6074).\n\nThe tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before\n4.9.11 allows remote attackers to cause a denial of service (infinite loop\nand soft lockup) via vectors involving a TCP packet with the URG flag\n(CVE-2017-6214).\n\nnet/sctp/socket.c in the Linux kernel through 4.10.1 does not properly\nrestrict association peel-off operations during certain wait states, which\nallows local users to cause a denial of service (invalid unlock and double\nfree) via a multithreaded application (CVE-2017-6353).\n\nFor other upstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2017-02-25T08:29:30Z","modified":"2026-04-16T06:23:17.213917172Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"MGASA-2017-0064","title":"Updated kernel-tmb packages fixes security vulnerabilities","description":"This kernel-tmb update is based on upstream 4.4.50 and fixes at least\nthe following security issues:\n\nThe cgroup offline implementation in the Linux kernel through 4.8.11\nmishandles certain drain operations, which allows local users to cause\na denial of service (system hang) by leveraging access to a container\nenvironment for executing a crafted application, as demonstrated by\ntrinity (CVE-2016-9191).\n\narch/x86/kvm/vmx.c in the Linux kernel through 4.9 mismanages the #BP\nand #OF exceptions, which allows guest OS users to cause a denial of\nservice (guest OS crash) by declining to handle an exception thrown by\nan L2 guest (CVE-2016-9588).\n\nThe sg implementation in the Linux kernel through 4.9 does not properly\nrestrict write operations in situations where the KERNEL_DS option is set,\nwhich allows local users to read or write to arbitrary kernel memory\nlocations or cause a denial of service (use-after-free) by leveraging\naccess to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c\n(CVE-2016-10088).\n\nThe ext4_fill_super function in fs/ext4/super.c in the Linux kernel\nthrough 4.9.8 does not properly validate meta block groups, which\nallows physically proximate attackers to cause a denial of service\n(out-of-bounds read and system crash) via a crafted ext4 image\n(CVE-2016-10208).\n\nThe load_segment_descriptor implementation in arch/x86/kvm/emulate.c in\nthe Linux kernel before 4.9.5 improperly emulates a \"MOV SS, NULL\nselector\" instruction, which allows guest OS users to cause a denial of\nservice (guest OS crash) or gain guest OS privileges via a crafted\napplication (CVE-2017-2583).\n\narch/x86/kvm/emulate.c in the Linux kernel through 4.9.3 allows local\nusers to obtain sensitive information from kernel memory or cause a\ndenial of service (use-after-free) via a crafted application that\nleverages instruction emulation for fxrstor, fxsave, sgdt, and sidt\n(CVE-2017-2584).\n\ndrivers/hid/hid-corsair.c in the Linux kernel 4.9.x before 4.9.6\ninteracts incorrectly with the CONFIG_VMAP_STACK option, which allows\nlocal users to cause a denial of service (system crash or memory\ncorruption) or possibly have unspecified other impact by leveraging\nuse of more than one virtual page for a DMA scatterlist (CVE-2017-5547).\n\ndrivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6\ninteracts incorrectly with the CONFIG_VMAP_STACK option, which allows\nlocal users to cause a denial of service (system crash or memory\ncorruption) or possibly have unspecified other impact by leveraging\nuse of more than one virtual page for a DMA scatterlist (CVE-2017-5548).\n\nThe klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c\nin the Linux kernel before 4.9.5 places uninitialized heap-memory\ncontents into a log entry upon a failure to read the line status, which\nallows local users to obtain sensitive information by reading the log\n(CVE-2017-5549).\n\nThe simple_set_acl function in fs/posix_acl.c in the Linux kernel before\n4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs\nfilesystem, which allows local users to gain group privileges by\nleveraging the existence of a setgid program with restrictions on\nexecute permissions (CVE-2017-5551).\n\nAn issue was found in the Linux kernel ipv6 implementation of GRE tunnels\nwhich allows a remote attacker to trigger an out-of-bounds access\n(CVE-2017-5897).\n\nThe ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux\nkernel through 4.9.9 allows attackers to cause a denial of service\n(system crash) via (1) an application that makes crafted system calls or\npossibly (2) IPv4 traffic with invalid IP options (CVE-2017-5970).\n\nRace condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c\nin the Linux kernel before 4.9.11 allows local users to cause a denial\nof service (assertion failure and panic) via a multithreaded application\nthat peels off an association in a certain buffer-full state\n(CVE-2017-5986).\n\nThe dccp_rcv_state_process function in net/dccp/input.c in the Linux\nkernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures\nin the LISTEN state, which allows local users to obtain root privileges\nor cause a denial of service (double free) via an application that makes\nan IPV6_RECVPKTINFO setsockopt system call (CVE-2017-6074).\n\nThe tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before\n4.9.11 allows remote attackers to cause a denial of service (infinite loop\nand soft lockup) via vectors involving a TCP packet with the URG flag\n(CVE-2017-6214).\n\nnet/sctp/socket.c in the Linux kernel through 4.10.1 does not properly\nrestrict association peel-off operations during certain wait states, which\nallows local users to cause a denial of service (invalid unlock and double\nfree) via a multithreaded application (CVE-2017-6353).\n\nFor other upstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2017-02-25T08:29:30Z","modified":"2026-04-16T06:26:02.360594521Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"MGASA-2017-0065","title":"Updated kernel-linus fixes security vulnerabilities","description":"This kernel-linus update is based on upstream 4.4.50 and fixes at least\nthe following security issues:\n\nThe cgroup offline implementation in the Linux kernel through 4.8.11\nmishandles certain drain operations, which allows local users to cause\na denial of service (system hang) by leveraging access to a container\nenvironment for executing a crafted application, as demonstrated by\ntrinity (CVE-2016-9191).\n\narch/x86/kvm/vmx.c in the Linux kernel through 4.9 mismanages the #BP\nand #OF exceptions, which allows guest OS users to cause a denial of\nservice (guest OS crash) by declining to handle an exception thrown by\nan L2 guest (CVE-2016-9588).\n\nThe sg implementation in the Linux kernel through 4.9 does not properly\nrestrict write operations in situations where the KERNEL_DS option is set,\nwhich allows local users to read or write to arbitrary kernel memory\nlocations or cause a denial of service (use-after-free) by leveraging\naccess to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c\n(CVE-2016-10088).\n\nThe ext4_fill_super function in fs/ext4/super.c in the Linux kernel\nthrough 4.9.8 does not properly validate meta block groups, which\nallows physically proximate attackers to cause a denial of service\n(out-of-bounds read and system crash) via a crafted ext4 image\n(CVE-2016-10208).\n\nThe load_segment_descriptor implementation in arch/x86/kvm/emulate.c in\nthe Linux kernel before 4.9.5 improperly emulates a \"MOV SS, NULL\nselector\" instruction, which allows guest OS users to cause a denial of\nservice (guest OS crash) or gain guest OS privileges via a crafted\napplication (CVE-2017-2583).\n\narch/x86/kvm/emulate.c in the Linux kernel through 4.9.3 allows local\nusers to obtain sensitive information from kernel memory or cause a\ndenial of service (use-after-free) via a crafted application that\nleverages instruction emulation for fxrstor, fxsave, sgdt, and sidt\n(CVE-2017-2584).\n\ndrivers/hid/hid-corsair.c in the Linux kernel 4.9.x before 4.9.6\ninteracts incorrectly with the CONFIG_VMAP_STACK option, which allows\nlocal users to cause a denial of service (system crash or memory\ncorruption) or possibly have unspecified other impact by leveraging\nuse of more than one virtual page for a DMA scatterlist (CVE-2017-5547).\n\ndrivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6\ninteracts incorrectly with the CONFIG_VMAP_STACK option, which allows\nlocal users to cause a denial of service (system crash or memory\ncorruption) or possibly have unspecified other impact by leveraging\nuse of more than one virtual page for a DMA scatterlist (CVE-2017-5548).\n\nThe klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c\nin the Linux kernel before 4.9.5 places uninitialized heap-memory\ncontents into a log entry upon a failure to read the line status, which\nallows local users to obtain sensitive information by reading the log\n(CVE-2017-5549).\n\nThe simple_set_acl function in fs/posix_acl.c in the Linux kernel before\n4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs\nfilesystem, which allows local users to gain group privileges by\nleveraging the existence of a setgid program with restrictions on\nexecute permissions (CVE-2017-5551).\n\nAn issue was found in the Linux kernel ipv6 implementation of GRE tunnels\nwhich allows a remote attacker to trigger an out-of-bounds access\n(CVE-2017-5897).\n\nThe ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux\nkernel through 4.9.9 allows attackers to cause a denial of service\n(system crash) via (1) an application that makes crafted system calls or\npossibly (2) IPv4 traffic with invalid IP options (CVE-2017-5970).\n\nRace condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c\nin the Linux kernel before 4.9.11 allows local users to cause a denial\nof service (assertion failure and panic) via a multithreaded application\nthat peels off an association in a certain buffer-full state\n(CVE-2017-5986).\n\nThe dccp_rcv_state_process function in net/dccp/input.c in the Linux\nkernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures\nin the LISTEN state, which allows local users to obtain root privileges\nor cause a denial of service (double free) via an application that makes\nan IPV6_RECVPKTINFO setsockopt system call (CVE-2017-6074).\n\nThe tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before\n4.9.11 allows remote attackers to cause a denial of service (infinite loop\nand soft lockup) via vectors involving a TCP packet with the URG flag\n(CVE-2017-6214).\n\nnet/sctp/socket.c in the Linux kernel through 4.10.1 does not properly\nrestrict association peel-off operations during certain wait states, which\nallows local users to cause a denial of service (invalid unlock and double\nfree) via a multithreaded application (CVE-2017-6353).\n\nFor other upstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2017-02-25T08:29:30Z","modified":"2026-04-16T06:26:17.504761968Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}