CVE-2017-12762: Buffer Overflow

Q: What is CVE-2017-12762?

CVE-2017-12762 is a vulnerability in the Linux kernel that allows for buffer overflow by copying a user-controlled buffer into a local buffer of constant size without a length check.

Q: Which software versions are affected by CVE-2017-12762?

CVE-2017-12762 affects the Linux kernel 4.9-stable, 4.12-stable, 3.18-stable, and 4.4-stable versions.

Q: How severe is CVE-2017-12762?

CVE-2017-12762 is a vulnerability that can lead to a buffer overflow, which can be exploited by an attacker to execute arbitrary code or crash the system.

Q: Is there a fix for CVE-2017-12762?

Yes, there are fixes available for CVE-2017-12762. Users should update their Linux kernel to a version that includes the fix.

Q: Where can I find more information about CVE-2017-12762?

You can find more information about CVE-2017-12762 at the following references: [Patchwork](https://patchwork.kernel.org/patch/9880041/), [SecurityFocus](http://www.securityfocus.com/bid/100251), [Ubuntu Security Notice](https://usn.ubuntu.com/3620-1/)

Published Aug 9, 2017

Updated

In /drivers/isdn/i4l/isdnnet.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check which can cause a buffer overflow. This affects the Linux kernel 4.9-stable tree, 4.12-stable tree, 3.18-stable tree, and 4.4-stable tree.

Affected Software

30 affected componentsFixes available

Linux Linux kernel>=3.18<3.18.64

Linux Linux kernel>=3.19<=4.4.80

Linux Linux kernel>=4.5<=4.9.41

Linux Linux kernel>=4.10<=4.12.5

Canonical Ubuntu Linux=12.04

Canonical Ubuntu Linux=14.04

debian/linux

6.1.176-16.1.190-16.12.107-16.12.113-17.2.12-17.2.13-1

ubuntu/linux<3.13.0-144.193

3.13.0-144.193

ubuntu/linux-lts-xenial<4.4.0-96.119~14.04.1

4.4.0-96.119~14.04.1

ubuntu/linux<4.4.0-96.119

4.4.0-96.119

ubuntu/linux-aws<4.4.0-1035.44

4.4.0-1035.44

ubuntu/linux-azure<4.13.0-1005.7

4.13.0-1005.7

ubuntu/linux-gcp<4.13.0-1002.5

4.13.0-1002.5

ubuntu/linux-gke<4.4.0-1031.31

4.4.0-1031.31

ubuntu/linux-hwe<4.13.0-32.35~16.04.1

4.13.0-32.35~16.04.1

ubuntu/linux-raspi2<4.4.0-1074.82

4.4.0-1074.82

ubuntu/linux-snapdragon<4.4.0-1076.81

4.4.0-1076.81

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15*

ubuntu/linux-gke*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-azure-6.11*

ubuntu/linux-gcp-6.11*

ubuntu/linux-hwe-6.11*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-raspi-realtime*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 3.13.0-144.193
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-96.119~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-96.119
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1035.44
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.13.0-1005.7
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.13.0-1002.5
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 4.4.0-1031.31
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.13.0-32.35~16.04.1
Upgrade
Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.
Fixed in 4.4.0-1074.82
Upgrade
Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.
Fixed in 4.4.0-1076.81

Event History

Aug 9, 2017

CVE Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

RemedyDescriptionSeverityAffected Software

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Data Sourced

via NVD·09:29 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2017-12762?

CVE-2017-12762 is a vulnerability in the Linux kernel that allows for buffer overflow by copying a user-controlled buffer into a local buffer of constant size without a length check.

Which software versions are affected by CVE-2017-12762?

CVE-2017-12762 affects the Linux kernel 4.9-stable, 4.12-stable, 3.18-stable, and 4.4-stable versions.

How severe is CVE-2017-12762?

CVE-2017-12762 is a vulnerability that can lead to a buffer overflow, which can be exploited by an attacker to execute arbitrary code or crash the system.

Is there a fix for CVE-2017-12762?

Yes, there are fixes available for CVE-2017-12762. Users should update their Linux kernel to a version that includes the fix.

Where can I find more information about CVE-2017-12762?

You can find more information about CVE-2017-12762 at the following references: [Patchwork](https://patchwork.kernel.org/patch/9880041/), [SecurityFocus](http://www.securityfocus.com/bid/100251), [Ubuntu Security Notice](https://usn.ubuntu.com/3620-1/)

CVE-2017-12762: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

What is CVE-2017-12762?

Which software versions are affected by CVE-2017-12762?

How severe is CVE-2017-12762?

Is there a fix for CVE-2017-12762?

Where can I find more information about CVE-2017-12762?

Company

Resources

Contact