CVE-2017-17862: Input Validation
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable code, even though it would still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic issue, could possibly be used by local users for denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.7-1Fixed in 7.1.8-1 - Upgrade
Upgrade
Linux kernel (kernel/bpf/verifier.c)to a version that resolves this vulnerability.Fixed in 4.14.8 - Compensating control
Mitigate potential local denial-of-service by restricting untrusted/local users’ ability to load or execute eBPF programs (e.g., via system policy/control of who can use bpf tooling or manage CAP_BPF/CAP_SYS_ADMIN for eBPF).
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2017-17862.
What is the description of this vulnerability?
The vulnerability allows local users to cause a denial of service by exploiting improper branch-pruning logic in the Linux kernel.
Which versions of the Linux kernel are affected by this vulnerability?
Linux kernel versions up to and including 4.14.8 are affected.
How can I fix this vulnerability?
Apply the recommended updates for your Linux distribution to upgrade the Linux kernel to version 4.15 or higher.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability in the references provided.