Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveRedhatCVE-2017-7558
HistoryJul 26, 2018 - 3:29 p.m.

CVE-2017-7558

2018-07-2615:29:00
CWE-125
redhat
web.nvd.nist.gov
221
cve-2017-7558
linux kernel
data leak
out-of-bound read
inet_diag_msg_sctpaddr_fill
sctp_get_sctp_info
nvd

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.9

Confidence

High

EPSS

0.008

Percentile

81.5%

JSON

A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() functions present since version 4.7-rc1 through version 4.13. A data leak happens when these functions fill in sockaddr data structures used to export socket’s diagnostic information. As a result, up to 100 bytes of the slab data could be leaked to a userspace.

Affected configurations

Nvd
Vulners
Node
linuxlinux_kernelRange4.7–4.13
OR
linuxlinux_kernelMatch4.7rc1
OR
linuxlinux_kernelMatch4.7rc2
OR
linuxlinux_kernelMatch4.7rc3
OR
linuxlinux_kernelMatch4.7rc4
OR
linuxlinux_kernelMatch4.7rc5
OR
linuxlinux_kernelMatch4.7rc6
OR
linuxlinux_kernelMatch4.7rc7
Node
debiandebian_linuxMatch8.0
OR
debiandebian_linuxMatch9.0
VendorProductVersionCPE
linuxlinux_kernel*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linuxlinux_kernel4.7cpe:2.3:o:linux:linux_kernel:4.7:rc1:*:*:*:*:*:*
linuxlinux_kernel4.7cpe:2.3:o:linux:linux_kernel:4.7:rc2:*:*:*:*:*:*
linuxlinux_kernel4.7cpe:2.3:o:linux:linux_kernel:4.7:rc3:*:*:*:*:*:*
linuxlinux_kernel4.7cpe:2.3:o:linux:linux_kernel:4.7:rc4:*:*:*:*:*:*
linuxlinux_kernel4.7cpe:2.3:o:linux:linux_kernel:4.7:rc5:*:*:*:*:*:*
linuxlinux_kernel4.7cpe:2.3:o:linux:linux_kernel:4.7:rc6:*:*:*:*:*:*
linuxlinux_kernel4.7cpe:2.3:o:linux:linux_kernel:4.7:rc7:*:*:*:*:*:*
debiandebian_linux8.0cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
debiandebian_linux9.0cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

CNA Affected

[
  {
    "product": "kernel",
    "vendor": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.7-rc1 through 4.13"
      }
    ]
  }
]

Related

redhatcve 1
prion 1
debiancve 1
openvas 12
fedora 5
zdt 1
exploitpack 1
nessus 16
veracode 1
nvd 1
exploitdb 1
ibm 3
packetstorm 1
ubuntucve 1
cvelist 1
amazon 1
virtuozzo 2
photon 1
redhat 3
centos 1
mageia 3
oraclelinux 2
debian 2
redhatcve
redhatcve
CVE-2017-7558
2019-10-10 04:12:53
prion
prion
Design/Logic Flaw
2018-07-26 15:29:00
debiancve
debiancve
CVE-2017-7558
2018-07-26 15:29:00
openvas
openvas
Fedora Update for kernel FEDORA-2017-4b4c022807
2017-09-02 00:00:00
Fedora Update for kernel FEDORA-2017-78c4c71539
2017-09-01 00:00:00
CentOS Update for kernel CESA-2017:2930 centos7
2017-10-25 00:00:00
fedora
fedora
[SECURITY] Fedora 26 Update: kernel-4.12.9-300.fc26
2017-08-31 22:55:38
[SECURITY] Fedora 25 Update: kernel-4.12.9-200.fc25
2017-09-01 03:24:31
[SECURITY] Fedora 26 Update: kernel-4.16.11-100.fc26
2018-05-29 11:10:03
zdt
zdt
Linux Kernel 4.8 (Ubuntu 16.04) - Leak sctp Kernel Pointer Exploit
2018-12-01 00:00:00
exploitpack
exploitpack
Linux Kernel 4.8 (Ubuntu 16.04) - Leak sctp Kernel Pointer
2018-11-30 00:00:00
nessus
nessus
Fedora 25 : kernel (2017-4b4c022807)
2017-09-01 00:00:00
Fedora 26 : kernel (2017-78c4c71539)
2017-09-01 00:00:00
Amazon Linux AMI : kernel (ALAS-2017-901)
2017-10-04 00:00:00
veracode
veracode
Information Disclosure
2019-05-16 01:48:54
nvd
nvd
CVE-2017-7558
2018-07-26 15:29:00
exploitdb
exploitdb
Linux Kernel 4.8 (Ubuntu 16.04) - Leak sctp Kernel Pointer
2018-11-30 00:00:00
ibm
ibm
Security Bulletin: IBM Security Access Manager Appliance is affected by a kernel vulnerability (CVE-2017-7558)
2018-08-23 02:47:38
Security Bulletin: IBM QRadar Network Security is affected by Linux kernel vulnerabilities
2018-07-25 14:37:35
Security Bulletin: Vulnerabilities in the Linux kernel affect PowerKVM
2018-07-06 23:49:08
packetstorm
packetstorm
Linux Kernel 4.8 (Ubuntu 16.04) sctp Kernel Pointer Leak
2018-12-01 00:00:00
ubuntucve
ubuntucve
CVE-2017-7558
2018-07-26 00:00:00
cvelist
cvelist
CVE-2017-7558
2018-07-26 15:00:00
amazon
amazon
Medium: kernel
2017-10-03 11:00:00
virtuozzo
virtuozzo
Kernel security update: CVE-2017-9242 and other; Virtuozzo ReadyKernel patch 30.3 for Virtuozzo 7.0.4 and 7.0.4 HF3
2017-09-06 00:00:00
Kernel security update: CVE-2017-9242 and other; Virtuozzo ReadyKernel patch 30.3 for Virtuozzo 7.0.5
2017-09-06 00:00:00
photon
photon
Important Photon OS Security Update - PHSA-2018-0082
2018-08-10 00:00:00
redhat
redhat
(RHSA-2017:2918) Important: kernel-rt security and bug fix update
2017-10-19 13:10:34
(RHSA-2017:2931) Important: kernel-rt security and bug fix update
2017-10-19 13:19:05
(RHSA-2017:2930) Important: kernel security and bug fix update
2017-10-19 13:19:00
centos
centos
kernel, perf, python security update
2017-10-23 17:05:09
mageia
mageia
Updated kernel-linus packages fix security vulnerabilities
2017-10-24 08:50:58
Updated kernel-tmb packages fix security vulnerabilities
2017-10-24 08:50:58
Updated kernel packages fix security vulnerabilities
2017-10-20 01:05:51
oraclelinux
oraclelinux
kernel security and bug fix update
2017-10-20 00:00:00
kernel security and bug fix update
2017-10-19 00:00:00
debian
debian
[SECURITY] [DSA 3981-1] linux security update
2017-09-20 21:35:52
[SECURITY] [DSA 3981-1] linux security update
2017-09-20 21:35:52

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.9

Confidence

High

EPSS

0.008

Percentile

81.5%

JSON
Related for CVE-2017-7558
redhatcve1prion1debiancve1openvas12fedora5zdt1exploitpack1nessus16veracode1nvd1exploitdb1ibm3packetstorm1ubuntucve1cvelist1amazon1virtuozzo2photon1redhat3centos1mageia3oraclelinux2debian2