Vulnerability Details : CVE-2017-5970
The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel through 4.9.9 allows attackers to cause a denial of service (system crash) via (1) an application that makes crafted system calls or possibly (2) IPv4 traffic with invalid IP options.
Vulnerability category: Denial of service
Products affected by CVE-2017-5970
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-5970
1.56%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 80 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-5970
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2017-5970
-
The product dereferences a pointer that it expects to be valid but is NULL.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-5970
-
http://www.debian.org/security/2017/dsa-3791
Debian -- Security Information -- DSA-3791-1 linux
-
https://patchwork.ozlabs.org/patch/724136/
[PATH,net] ipv4: keep skb->dst around in presence of IP options - PatchworkPatch;Third Party Advisory
-
https://github.com/torvalds/linux/commit/34b2cef20f19c87999fff3da4071e66937db9644
ipv4: keep skb->dst around in presence of IP options · torvalds/linux@34b2cef · GitHubIssue Tracking;Patch;Third Party Advisory
-
http://www.securityfocus.com/bid/96233
Linux kernel 'ip_sockglue.c' Denial of Service Vulnerability
-
https://bugzilla.redhat.com/show_bug.cgi?id=1421638
1421638 – (CVE-2017-5970) CVE-2017-5970 kernel: ipv4: Invalid IP options could cause skb->dst dropIssue Tracking;Patch
-
https://access.redhat.com/errata/RHSA-2017:1842
RHSA-2017:1842 - Security Advisory - Red Hat Customer Portal
-
https://access.redhat.com/errata/RHSA-2017:2077
RHSA-2017:2077 - Security Advisory - Red Hat Customer Portal
-
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=34b2cef20f19c87999fff3da4071e66937db9644
kernel/git/torvalds/linux.git - Linux kernel source treeIssue Tracking;Patch
-
http://www.openwall.com/lists/oss-security/2017/02/12/3
oss-security - Fwd: [scr293903] Linux kernel - upstreamMailing List;Patch;Third Party Advisory
-
https://source.android.com/security/bulletin/2017-07-01
-
https://access.redhat.com/errata/RHSA-2017:2669
RHSA-2017:2669 - Security Advisory - Red Hat Customer Portal
Jump to