Vulnerability Details : CVE-2017-7308

Public exploit exists!
The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate certain block-size data, which allows local users to cause a denial of service (integer signedness error and out-of-bounds write), or gain privileges (if the CAP_NET_RAW capability is held), via crafted system calls.
Published 2017-03-29 20:59:00
Updated 2023-02-14 18:32:40
Source MITRE
View at NVD,   CVE.org
Vulnerability category: Memory CorruptionDenial of service

Products affected by CVE-2017-7308

Threat overview for CVE-2017-7308

Top countries where our scanners detected CVE-2017-7308
Top open port discovered on systems with this issue 49152
IPs affected by CVE-2017-7308 28,507
Threat actors abusing to this issue? Yes
Find out if you* are affected by CVE-2017-7308!
*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2017-7308

EPSS FAQ
86.29%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2017-7308

  • AF_PACKET packet_set_ring Privilege Escalation
    Disclosure Date: 2017-03-29
    First seen: 2020-04-26
    exploit/linux/local/af_packet_packet_set_ring_priv_esc
    This module exploits a heap-out-of-bounds write in the packet_set_ring function in net/packet/af_packet.c (AF_PACKET) in the Linux kernel to execute code as root (CVE-2017-7308). The bug was initially introduced in 2011 and patched in version 4.10.6, potenti

CVSS scores for CVE-2017-7308

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.2
 HIGH AV:L/AC:L/Au:N/C:C/I:C/A:C
3.9
10.0
 NIST
7.8
 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1.8
5.9
 NIST

CWE ids for CVE-2017-7308

  • When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
    Assigned by: nvd@nist.gov (Primary)
  • The product writes data past the end, or before the beginning, of the intended buffer.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-7308

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close