CVE-2017-7187: Buffer Overflow
Last updated 29 November 2024
Other sources
The sgioctl function in drivers/scsi/sg.c in the Linux kernel allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SGNEXTCMDLEN ioctl call, leading to out-of-bounds write access in the sgwrite function.
Upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bf33f87dd04c371ea33feb821b60d63d754e3124
References:
https://gist.github.com/dvyukov/48ad14e84de45b0be92b7f0eda20ff1b
— Red Hat
The sgioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SGNEXTCMDLEN ioctl call, leading to out-of-bounds write access in the sgwrite function.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 4.10.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch bf33f87dd04c371ea33feb821b60d63d754e3124
Event History
Frequently Asked Questions
What is CVE-2017-7187?
CVE-2017-7187 is a vulnerability in the Linux kernel that allows local users to cause a denial of service or have unspecified other impact.
How severe is CVE-2017-7187?
CVE-2017-7187 has a severity rating of medium.
What is the affected software for CVE-2017-7187?
The affected software for CVE-2017-7187 includes the Linux kernel versions up to 4.10.4 and specific Ubuntu Linux versions.
How do I fix CVE-2017-7187?
To fix CVE-2017-7187, update your Linux kernel to version 4.11~ or apply the specific Ubuntu Linux patches provided.
Where can I find more information about CVE-2017-7187?
You can find more information about CVE-2017-7187 in the references provided, including the Git commit, a GitHub gist, and a Bugzilla entry.