CVE-2017-18222: Buffer Overflow
In the Linux kernel before 4.12, Hisilicon Network Subsystem (HNS) does not consider the ETHSSPRIVFLAGS case when retrieving ssetcount data, which allows local users to cause a denial of service (buffer overflow and memory corruption) or possibly have unspecified other impact, as demonstrated by incompatibility between hnsgetssetcount and ethtoolgetstrings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1
Event History
Frequently Asked Questions
What is CVE-2017-18222?
CVE-2017-18222 is a vulnerability in the Linux kernel before version 4.12 that allows local users to cause a denial of service or possibly have unspecified other impact.
Which software is affected by CVE-2017-18222?
The Linux kernel versions before 4.12, including Ubuntu packages 'linux' and 'linux-armadaxp', are affected by CVE-2017-18222.
How can CVE-2017-18222 be fixed?
To fix CVE-2017-18222, upgrade the Linux kernel to version 4.12 or later.
Is there a patch available for CVE-2017-18222?
Yes, a patch for CVE-2017-18222 is available in the Linux kernel source code repository.
Where can I find more information about CVE-2017-18222?
More information about CVE-2017-18222 can be found at the following references: [link1](http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=412b65d15a7f8a93794653968308fc100f2aa87c), [link2](https://github.com/torvalds/linux/commit/412b65d15a7f8a93794653968308fc100f2aa87c), [link3](http://www.securityfocus.com/bid/103349).