The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This type value is uninitialized upon encountering certain error conditions. This value is used as an array index for dereferencing, which leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the whole system.
Published 2017-07-02 17:29:00
Updated 2023-02-03 02:02:20
Source MITRE
View at NVD,   CVE.org
Vulnerability category: Denial of service

Exploit prediction scoring system (EPSS) score for CVE-2017-8797

Probability of exploitation activity in the next 30 days: 87.42%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 98 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2017-8797

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source
7.8
HIGH AV:N/AC:L/Au:N/C:N/I:N/A:C
10.0
6.9
NIST
7.5
HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3.9
3.6
NIST

CWE ids for CVE-2017-8797

  • The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-8797

Products affected by CVE-2017-8797

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!