Vulnerability Details : CVE-2017-7477
Heap-based buffer overflow in drivers/net/macsec.c in the MACsec module in the Linux kernel through 4.10.12 allows attackers to cause a denial of service or possibly have unspecified other impact by leveraging the use of a MAX_SKB_FRAGS+1 size in conjunction with the NETIF_F_FRAGLIST feature, leading to an error in the skb_to_sgvec function.
Vulnerability category: OverflowDenial of service
Products affected by CVE-2017-7477
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Threat overview for CVE-2017-7477
Top countries where our scanners detected CVE-2017-7477
Top open port discovered on systems with this issue
80
IPs affected by CVE-2017-7477 9
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2017-7477!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2017-7477
0.07%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 29 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-7477
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.9
|
MEDIUM | AV:L/AC:M/Au:N/C:C/I:C/A:C |
3.4
|
10.0
|
NIST | |
|
7.0
|
HIGH | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.0
|
5.9
|
NIST | |
|
7.0
|
HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.0
|
5.9
|
NIST |
CWE ids for CVE-2017-7477
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-7477
-
http://www.securitytracker.com/id/1038500
Linux Kernel Heap Overflow in MACsec Driver Lets Remote Users Execute Arbitrary Code - SecurityTrackerThird Party Advisory;VDB Entry
-
https://access.redhat.com/errata/RHSA-2017:1615
RHSA-2017:1615 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.securityfocus.com/bid/98014
Linux Kernel CVE-2017-7477 Heap Buffer Overflow VulnerabilityThird Party Advisory;VDB Entry
-
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=5294b83086cc1c35b4efeca03644cf9d12282e5b
kernel/git/davem/net.git - Netdev Group's networking treePatch
-
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=4d6fa57b4dab0d77f4d8e9d9c73d1e63f6fe8fee
kernel/git/davem/net.git - Netdev Group's networking treePatch
-
https://bugzilla.redhat.com/show_bug.cgi?id=1445207
1445207 – (CVE-2017-7477) CVE-2017-7477 kernel: net: Heap overflow in skb_to_sgvec in macsec.cIssue Tracking;Patch;Third Party Advisory
-
https://access.redhat.com/errata/RHSA-2017:1616
RHSA-2017:1616 - Security Advisory - Red Hat Customer PortalThird Party Advisory
Jump to