CVE-2017-17806

kernel: HMAC implementation does not validate that the underlying cryptographic hash algorithm is unkeyed allowing local attackers to cause denial-of-service

The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 4 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 6 more

CVE-2017-17852

kernel: bpf/verifier.c allows local users to cause a denial of service by leveraging mishandling of 32-bit ALU ops

kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of 32-bit ALU ops.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux

Products

Debian Linux Linux Kernel

CVE-2017-17853

kernel: bpf/verifier.c allows local users to cause a denial of service by leveraging incorrect BPF_RSH signed bounds calculations

kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect BPF_RSH signed bounds calculations.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux

Products

Debian Linux Linux Kernel

CVE-2017-17854

kernel: bpf/verifier.c allows local users to cause a denial of service by leveraging unrestricted integer values for pointer arithmetic

kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (integer overflow and memory corruption) or possibly have unspecified other impact by leveraging unrestricted integer values for pointer arithmetic.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux

Products

Debian Linux Linux Kernel

CVE-2017-17855

kernel: bpf/verifier.c allows local users to cause a denial of service by leveraging improper use of pointers in place of scalars

kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging improper use of pointers in place of scalars.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux

Products

Debian Linux Linux Kernel

CVE-2017-17856

kernel: bpf/verifier.c allows local users to cause a denial of service by leveraging the lack of stack-pointer alignment enforcement

kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the lack of stack-pointer alignment enforcement.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux

Products

Debian Linux Linux Kernel

CVE-2017-17857

kernel: bpf/verifier.c allows local users to cause a denial of service by leveraging mishandling of invalid variable stack read operations

The check_stack_boundary function in kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of invalid variable stack read operations.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux

Products

Debian Linux Linux Kernel

CVE-2017-17862

kernel: Improper logic pruning in bpf/verifier.c

kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable code, even though it would still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic issue, could possibly be used by local users for denial of service.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Linux

Products

Debian Linux Linux Kernel

CVE-2017-17863

kernel: integer overflow in static int check_alu_op function in bpf/verifier.c

kernel/bpf/verifier.c in the Linux kernel 4.9.x through 4.9.71 does not check the relationship between pointer values and the BPF stack, which allows local users to cause a denial of service (integer overflow or invalid memory access) or possibly have unspecified other impact.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux

Products

Debian Linux Linux Kernel

CVE-2017-17864

kernel: information disclosure via pointer leak in kernel/bpf/verifier.c

kernel/bpf/verifier.c in the Linux kernel through 4.14.8 mishandles states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allows local users to obtain potentially sensitive address information, aka a "pointer leak."

CVSS 3.0 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Debian Linux

Products

Debian Linux Linux Kernel

CVE-2017-13086

wpa_supplicant: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 6.8 Medium EPSS 2.0% KEV · Not listed

Vendors

Canonical Debian Freebsd and 4 more

Products

Ubuntu Linux Debian Linux Freebsd and 10 more

CVE-2017-13084

wpa_supplicant: reinstallation of the STK key in the PeerKey handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 6.8 Medium EPSS 2.2% KEV · Not listed

Vendors

Canonical Debian Freebsd and 4 more

Products

Ubuntu Linux Debian Linux Freebsd and 9 more

CVE-2017-13082

wpa_supplicant: Accepting a retransmitted FT Reassociation Request and reinstalling the pairwise key while processing it

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 8.1 High EPSS 4.6% KEV · Not listed

Vendors

Canonical Debian Freebsd and 4 more

Products

Ubuntu Linux Debian Linux Freebsd and 10 more

CVE-2017-13081

wpa_supplicant: Reinstallation of the integrity group key in the group key handshake

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.0% KEV · Not listed

Vendors

Canonical Debian Freebsd and 4 more

Products

Ubuntu Linux Debian Linux Freebsd and 9 more

CVE-2017-13080

wpa_supplicant: Reinstallation of the group key in the group key handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.3% KEV · Not listed

Vendors

Canonical Debian Freebsd and 4 more

Products

Ubuntu Linux Debian Linux Freebsd and 10 more

CVE-2017-2636

kernel: Race condition access to n_hdlc.tbuf causes double free in n_hdlc_release()

Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline.

CVSS 3.1 · 7.0 High EPSS 1.0% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 6 more

CVE-2017-5029

chromium-browser: integer overflow in libxslt

The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Apple Debian Google and 4 more

Products

Macos Debian Linux Android and 8 more

CVE-2017-5033

chromium-browser: bypass of content security policy in blink

Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page, related to the unsafe-inline keyword.

CVSS 3.1 · 4.3 Medium EPSS 1.7% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5036

chromium-browser: use after free in pdfium

A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to have an unspecified impact via a crafted PDF file.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5037

chromium-browser: multiple out of bounds writes in chunkdemuxer

An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more