CVE-2017-14106: Divide by Zero
Divide-by-zero vulnerability was found in tcpselectwindow function which can result into kernel panic causing local denial-of-service if paniconoops is enabled.
References:
http://seclists.org/oss-sec/2017/q3/389
https://marc.info/?l=linux-netdev&m=150415901823078
https://www.mail-archive.com/netdev@vger.kernel.org/msg186255.html
https://groups.google.com/forum/#!topic/syzkaller/e4SrsEBEziQ
Upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=499350a5a6e7512d9ed369ed63a4244b6536f4f8
Other sources
The tcpdisconnect function in net/ipv4/tcp.c in the Linux kernel before 4.12 allows local users to cause a denial of service (tcpselectwindow divide-by-zero error and system crash) by triggering a disconnect within a certain tcprecvmsg code path.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2017-14106?
CVE-2017-14106 is a vulnerability that allows local users to cause a denial of service by triggering a disconnect within a certain tcp_recvmsg code path.
Which Linux kernel versions are affected by CVE-2017-14106?
Linux kernel versions before 4.12 are affected by CVE-2017-14106.
What is the severity of CVE-2017-14106?
CVE-2017-14106 has a medium severity with a CVSS score of 4.
How can I fix CVE-2017-14106?
To fix CVE-2017-14106, update your Linux kernel to version 4.12 or later.
Where can I find more information about CVE-2017-14106?
You can find more information about CVE-2017-14106 at the following references: [1] [2] [3].