CVE-2017-17448: High severity Linux Linux kernel vulnerability
net/netfilter/nfnetlinkcthelper.c in the Linux kernel through 4.14.4 does not require the CAPNETADMIN capability for new, get, and del operations, which allows local users to bypass intended access restrictions because the nfnlcthelperlist data structure is shared across all net namespaces.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 4b380c42f7d00a395feede754f0bc2292eebe6e5
Event History
Frequently Asked Questions
What is the severity of CVE-2017-17448?
CVE-2017-17448 is considered a medium severity vulnerability in the Linux kernel that allows local users to bypass access restrictions.
How do I fix CVE-2017-17448?
To fix CVE-2017-17448, upgrade your Linux kernel to version 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.11-1, or 6.12.12-1.
Which Linux kernel versions are affected by CVE-2017-17448?
CVE-2017-17448 affects Linux kernel versions up to and including 4.14.4.
What types of operations are impacted by CVE-2017-17448?
CVE-2017-17448 impacts new, get, and del operations on the nfnl_cthelper_list data structure.
Can local users exploit CVE-2017-17448?
Yes, local users can exploit CVE-2017-17448 to bypass intended access restrictions without needing the CAP_NET_ADMIN capability.