CVE-2017-7482
kernel: net/rxrpc: overflow in decoding of krb5 principal
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. This could possibly lead to memory corruption and possible privilege escalation.
en el kernel de Linux en versiones anteriores a la 4.12, los tickets de Kerberos 5 descifrados al emplear las claves RXRPC de forma incorrecta asumen el tamaño de un campo. Esto podría conducir a un wrapping de la variable que mantiene el tamaño y en que el puntero de datos vaya más allá final del búfer. Esto podría conducir a una corrupción de memoria y a un posible escalado de privilegios.
Keberos 5 tickets being decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. This could possibly lead to memory corruption and possible privilege escalation.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-04-05 CVE Reserved
- 2017-07-03 CVE Published
- 2023-07-24 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-190: Integer Overflow or Wraparound
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/99299 | Third Party Advisory | |
| http://www.securitytracker.com/id/1038787 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2019:0641 | 2023-02-14 | |
| https://www.debian.org/security/2017/dsa-3927 | 2023-02-14 | |
| https://www.debian.org/security/2017/dsa-3945 | 2023-02-14 | |
| https://access.redhat.com/security/cve/CVE-2017-7482 | 2019-03-26 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1446288 | 2019-03-26 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | < 3.2.90 Search vendor "Linux" for product "Linux Kernel" and version " < 3.2.90" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.3 < 3.10.108 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.3 < 3.10.108" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.11 < 3.16.45 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.11 < 3.16.45" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.17 < 3.18.59 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.17 < 3.18.59" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.19 < 4.1.43 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.19 < 4.1.43" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.2 < 4.4.75 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.2 < 4.4.75" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.5 < 4.9.35 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.5 < 4.9.35" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.10 < 4.11.8 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.10 < 4.11.8" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Mrg Search vendor "Redhat" for product "Enterprise Mrg" | 2.0 Search vendor "Redhat" for product "Enterprise Mrg" and version "2.0" | - |
Affected
| ||||||