CVE-2017-7477: Buffer Overflow
A heap overflow vulnerability was found in the Linux kernel in macsec module. Specifying MAXSKBFRAGS + 1 and using NETIFFFRAGLIST which calls skbtosgvec will overflow the heap.
Upstream patches:
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=4d6fa57b4dab0d77f4d8e9d9c73d1e63f6fe8fee https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=5294b83086cc1c35b4efeca03644cf9d12282e5b
Other sources
Heap-based buffer overflow in drivers/net/macsec.c in the MACsec module in the Linux kernel through 4.10.12 allows attackers to cause a denial of service or possibly have unspecified other impact by leveraging the use of a MAXSKBFRAGS+1 size in conjunction with the NETIFFFRAGLIST feature, leading to an error in the skbtosgvec function.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.133-1Fixed in 6.12.21-1Fixed in 6.12.22-1 - Compensating control
Blacklist the MACsec kernel module (drivers/net/macsec.c / Linux kernel MACsec module) to mitigate the heap overflow vulnerability in macsec through Linux kernel 4.10.12.
Event History
Frequently Asked Questions
What is CVE-2017-7477?
CVE-2017-7477 is a vulnerability in the MACsec module in the Linux kernel that allows attackers to cause a denial of service or possibly have other impacts.
How severe is CVE-2017-7477?
CVE-2017-7477 has a severity rating of high (7 out of 10).
Which versions of Linux kernel are affected by CVE-2017-7477?
CVE-2017-7477 affects Linux kernel versions up to 4.10.12.
How can I fix CVE-2017-7477?
To fix CVE-2017-7477, you should update your Linux kernel to a version beyond 4.10.12 or apply the necessary patches provided by your Linux distribution.
Where can I find more information about CVE-2017-7477?
You can find more information about CVE-2017-7477 in the references section: [link1](https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=4d6fa57b4dab0d77f4d8e9d9c73d1e63f6fe8fee), [link2](https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=5294b83086cc1c35b4efeca03644cf9d12282e5b), [link3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1445208).