CVE-2017-1000111

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that changes socket state may race with safety checks in packet_set_ring. Previously with PACKET_VERSION. This time with PACKET_RESERVE. The solution is similar: lock the socket for the update. This issue may be exploitable, we did not investigate further. As this issue affects PF_PACKET sockets, it requires CAP_NET_RAW in the process namespace. But note that with user namespaces enabled, any process can create a namespace in which it has CAP_NET_RAW.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Oct 5, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10001127.0Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() c CVE-2017-10001135.5The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file CVE-2017-10001143.1The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypte CVE-2017-10001157.5Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the reposito CVE-2017-10001169.8Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.CVE-2017-10001178.8A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any prog CVE-2017-10001187.5Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service CVE-2017-10001197.2October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other a CVE-2017-10001208.8[ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbit CVE-2017-10001219.8The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised CVE-2017-10001225.3The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate certain message metadata, allowing a compromi CVE-2017-10001257.5Codiad(full version) is vulnerable to write anything to configure file in the installation resulting upload a webshell.