CVE-2017-17840: Buffer Overflow
First published: Wed Dec 27 2017(Updated: )
An issue was discovered in Open-iSCSI through 2.0.875. A local attacker can cause the iscsiuio server to abort or potentially execute code by sending messages with incorrect lengths, which (due to lack of checking) can lead to buffer overflows, and result in aborts (with overflow checking enabled) or code execution. The process_iscsid_broadcast function in iscsiuio/src/unix/iscsid_ipc.c does not validate the payload length before a write operation.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Open-iscsi Project Open-iscsi | <=2.0.875 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-17840?
The severity of CVE-2017-17840 is high. Its severity score is 7.8.
What is the affected software of CVE-2017-17840?
The affected software of CVE-2017-17840 is Open-iscsi Project Open-iscsi version up to and including 2.0.875.
How can a local attacker exploit CVE-2017-17840?
A local attacker can cause the iscsiuio server to abort or potentially execute code by sending messages with incorrect lengths, leading to buffer overflows.
Are there any references related to CVE-2017-17840?
Yes, you can find references related to CVE-2017-17840 at the following links: http://www.openwall.com/lists/oss-security/2017/12/13/2 and https://bugzilla.opensuse.org/show_bug.cgi?id=1072312.
What is the Common Weakness Enumeration (CWE) ID of CVE-2017-17840?
The Common Weakness Enumeration (CWE) ID of CVE-2017-17840 is CWE-119.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/event
- agent/tags
- agent/description
- agent/first-publish-date
- vendor/open-iscsi project
- canonical/open-iscsi project open-iscsi
- version/open-iscsi project open-iscsi/2.0.875