CVE-2017-9075: High severity Linux Linux kernel vulnerability
Last updated 29 November 2024
Other sources
The sctpv6createacceptsk function in net/sctp/ipv6.c in the Linux kernel mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890.
Upstream patch:
https://github.com/torvalds/linux/commit/fdcee2cbb8438702ea1b328fb6e0ac5e9a40c7f8
References:
https://patchwork.ozlabs.org/patch/763569/
— Red Hat
The sctpv6createacceptsk function in net/sctp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 3.13.0-123.172 - Upgrade
Upgrade
ubuntu/linux-lts-xenialto a version that resolves this vulnerability.Fixed in 4.4.0-83.106~14.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 4.4.0-83.106 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 4.4.0-1022.31 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 4.4.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-hweto a version that resolves this vulnerability.Fixed in 4.10.0-32.36~16.04.1 - Upgrade
Upgrade
ubuntu/linux-raspi2to a version that resolves this vulnerability.Fixed in 4.4.0-1061.69 - Upgrade
Upgrade
ubuntu/linux-snapdragonto a version that resolves this vulnerability.Fixed in 4.4.0-1063.68
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2017-9075.
What is the severity level of CVE-2017-9075?
The severity level of CVE-2017-9075 is high with a severity value of 7.
What is the affected software?
The affected software includes various versions of the Linux kernel and Ubuntu packages, as well as Google Android.
How can an attacker exploit CVE-2017-9075?
An attacker can exploit CVE-2017-9075 by sending crafted system calls, which can cause a denial of service or other unspecified impact.
Where can I find more information about CVE-2017-9075?
You can find more information about CVE-2017-9075 on the Red Hat Security website, the Linux kernel GitHub repository, and the Patchwork mailing list.