NVD Vulnerability Detail

CVE-2017-11600

Summary	net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message.
Publication Date	July 24, 2017, 4:29 p.m.
Registration Date	Jan. 26, 2021, 1:13 p.m.
Last Update	Nov. 21, 2024, 12:08 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html	Mailing List Third Party Advisory
3	http://seclists.org/bugtraq/2017/Jul/30	Mailing List Third Party Advisory
4	http://seclists.org/bugtraq/2017/Jul/30	Mailing List Third Party Advisory
5	http://www.debian.org/security/2017/dsa-3981	Third Party Advisory
6	http://www.debian.org/security/2017/dsa-3981	Third Party Advisory
7	http://www.securityfocus.com/bid/99928	Third Party Advisory VDB Entry
8	http://www.securityfocus.com/bid/99928	Third Party Advisory VDB Entry
9	https://access.redhat.com/errata/RHSA-2018:1965	Third Party Advisory
10	https://access.redhat.com/errata/RHSA-2018:1965	Third Party Advisory
11	https://access.redhat.com/errata/RHSA-2018:2003	Third Party Advisory
12	https://access.redhat.com/errata/RHSA-2018:2003	Third Party Advisory
13	https://access.redhat.com/errata/RHSA-2019:1170	Third Party Advisory
14	https://access.redhat.com/errata/RHSA-2019:1170	Third Party Advisory
15	https://access.redhat.com/errata/RHSA-2019:1190	Third Party Advisory
16	https://access.redhat.com/errata/RHSA-2019:1190	Third Party Advisory
17	https://source.android.com/security/bulletin/pixel/2017-11-01	Third Party Advisory
18	https://source.android.com/security/bulletin/pixel/2017-11-01	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-125	境界外読み取り	https://cwe.mitre.org/data/definitions/125.html

JVN Vulnerability Information

Linux Kernel における境界外読み取りに関する脆弱性

Title	Linux Kernel における境界外読み取りに関する脆弱性
Summary	Linux Kernel には、境界外読み取りに関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	July 11, 2017, midnight
Registration Date	Aug. 28, 2017, 2:46 p.m.
Last Update	Aug. 28, 2017, 2:46 p.m.

Affected System

Linux

Linux Kernel 4.12.3 まで

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-11600	https://nvd.nist.gov/vuln/detail/CVE-2017-11600
National Vulnerability Database (NVD)
2	CVE-2017-11600	https://nvd.nist.gov/vuln/detail/CVE-2017-11600

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-125	https://cwe.mitre.org/data/definitions/125.html

ベンダー情報

No	Name	URL
Linux Kernel
1	Linux Kernel Archives	https://www.kernel.org/

その他

No	Name	URL
関連文書
1	[CVE request]linux kernel xfrm migrate out-of-bound access	http://seclists.org/bugtraq/2017/Jul/30

Change Log

No	Changed Details	Date of change
0	[2017年08月28日] 掲載	Feb. 17, 2018, 10:37 a.m.