CVE - CVE-2017-8797

CVE-ID
CVE-2017-8797	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This type value is uninitialized upon encountering certain error conditions. This value is used as an array index for dereferencing, which leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the whole system.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:99298 URL:http://www.securityfocus.com/bid/99298 MISC:http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b550a32e60a4941994b437a8d662432a486235a5 MISC:http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f961e3f2acae94b727380c0b74e2d3954d0edf79 MISC:http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.3 MISC:http://www.openwall.com/lists/oss-security/2017/06/27/5 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=1466329 MISC:https://github.com/torvalds/linux/commit/b550a32e60a4941994b437a8d662432a486235a5 MISC:https://github.com/torvalds/linux/commit/f961e3f2acae94b727380c0b74e2d3954d0edf79 REDHAT:RHSA-2017:1842 URL:https://access.redhat.com/errata/RHSA-2017:1842 REDHAT:RHSA-2017:2077 URL:https://access.redhat.com/errata/RHSA-2017:2077 REDHAT:RHSA-2017:2437 URL:https://access.redhat.com/errata/RHSA-2017:2437 REDHAT:RHSA-2017:2669 URL:https://access.redhat.com/errata/RHSA-2017:2669 SECTRACK:1038790 URL:http://www.securitytracker.com/id/1038790
Assigning CNA
MITRE Corporation
Date Record Created
20170505	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20170505)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)