CVE-2017-11171

https://notcve.org/view.php?id=CVE-2017-11171

Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible. Un mal conteo de referencias en el contexto de la función accept_ice_connection() en el archivo gsm-xsmp-server.c en versiones anteriores de gnome-session hasta la versión 2.29.92, permite a un atacante local establecer conexiones ICE en gnome-session con datos de autenticación no válidos (cookie magic no válida). • https://bugzilla.suse.com/show_bug.cgi?id=1025068 https://github.com/GNOME/gnome-session/commit/b0dc999e0b45355314616321dbb6cb71e729fc9d • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •