CVE-2017-12153

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

A security flaw was discovered in the nl80211_set_rekey_data() function in net/wireless/nl80211.c in the Linux kernel through 4.13.3. This function does not check whether the required attributes are present in a Netlink request. This request can be issued by a user with the CAP_NET_ADMIN capability and may result in a NULL pointer dereference and system crash.

Metrics

CVSS 3.0 4.4/10CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	kernel since v3.1-rc1 through v4.13	kernel since v3.1-rc1 through v4.13

References

http://seclists.org/oss-sec/2017/q3/437Mailing List, Patch, Third Party Advisory
http://www.debian.org/security/2017/dsa-3981Third Party Advisory
http://www.securityfocus.com/bid/100855Third Party Advisory, VDB Entry
https://bugzilla.novell.com/show_bug.cgi?id=1058410Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1491046Issue Tracking, Patch, Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git/commit/?id=e785fa0a164aa11001cba931367c7f94ffaff888Issue Tracking, Patch, Third Party Advisory
https://marc.info/?t=150525503100001&r=1&w=2Patch, Third Party Advisory
https://usn.ubuntu.com/3583-1/Third Party Advisory
https://usn.ubuntu.com/3583-2/Third Party Advisory
http://seclists.org/oss-sec/2017/q3/437Mailing List, Patch, Third Party Advisory
http://www.debian.org/security/2017/dsa-3981Third Party Advisory
http://www.securityfocus.com/bid/100855Third Party Advisory, VDB Entry
https://bugzilla.novell.com/show_bug.cgi?id=1058410Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1491046Issue Tracking, Patch, Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git/commit/?id=e785fa0a164aa11001cba931367c7f94ffaff888Issue Tracking, Patch, Third Party Advisory
https://marc.info/?t=150525503100001&r=1&w=2Patch, Third Party Advisory
https://usn.ubuntu.com/3583-1/Third Party Advisory
https://usn.ubuntu.com/3583-2/Third Party Advisory

Timeline

Published: Sep 21, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-121547.1The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and "CR8-st CVE-2017-121556.3A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world CVE-2017-121566.1Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback.CVE-2017-121574.3In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.CVE-2017-121585.4It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker c CVE-2017-121597.5It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain ac CVE-2017-121607.2It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication serve CVE-2017-121618.8It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset reque CVE-2017-121637.1An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.CVE-2017-121646.4A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If autologin was enabled CVE-2017-121657.5It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause poss CVE-2017-121669.8OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly r