CVE-2017-10662

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The sanity_check_raw_super function in fs/f2fs/super.c in the Linux kernel before 4.11.1 does not validate the segment count, which allows local users to gain privileges via unspecified vectors.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b9dd46188edc2f0d1f37328637860bb65a771124Mailing List, Patch, Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.1Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/100215Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1481146Issue Tracking, Patch
https://github.com/torvalds/linux/commit/b9dd46188edc2f0d1f37328637860bb65a771124Patch, Third Party Advisory
https://source.android.com/security/bulletin/2017-08-01Third Party Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b9dd46188edc2f0d1f37328637860bb65a771124Mailing List, Patch, Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.1Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/100215Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1481146Issue Tracking, Patch
https://github.com/torvalds/linux/commit/b9dd46188edc2f0d1f37328637860bb65a771124Patch, Third Party Advisory
https://source.android.com/security/bulletin/2017-08-01Third Party Advisory

Timeline

Published: Aug 19, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-106637.8The sanity_check_ckpt function in fs/f2fs/super.c in the Linux kernel before 4.12.4 does not validate the blkoff and segno arrays, which all CVE-2017-106647.5qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by CVE-2017-106657.8Directory traversal vulnerability in ajaxfileupload.php in Kayson Group Ltd. phpGrid before 7.2.5 allows remote attackers to execute arbitra CVE-2017-106676.1In index.php in Zen Cart 1.6.0, the products_id parameter can cause XSS.CVE-2017-106685.9A Padding Oracle exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). Under an CVE-2017-106696.5Signature Wrapping exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). An att CVE-2017-106709.8An XML External Entity (XXE) issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.CVE-2017-106717.8Heap-based Buffer Overflow in the de_dotdot function in libhttpd.c in sthttpd before 2.27.1 allows remote attackers to cause a denial of ser CVE-2017-106729.8Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the argumen CVE-2017-106736.1admin/profile.php in GetSimple CMS 3.x has XSS in a name field.CVE-2017-106745.5Antiy Antivirus Engine 5.0.0.06281654 allows local users to cause a denial of service (BSOD) via a long third argument in a DeviceIoControl CVE-2017-106766.1On D-Link DIR-600M devices before C1_v3.05ENB01_beta_20170306, XSS was found in the form2userconfig.cgi username parameter.