Vulnetix
Try Vulnetix Request Demo
CVE-2017-17806 PUBLISHED

The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.

EPSS 0.01% · 1.2th percentile

Risk Scores

EPSS Score
0.01%
1.2th percentile

Affected Products

VendorProductVersions
Ubuntu:24.04:LTSlinux-azure-6.110, 6.11.0-1008.8~24.04.1, 6.11.0-1012.12~24.04.1
Ubuntu:14.04:LTSlinux-aws4.4.0-1010.10, 4.4.0-1012.12, 4.4.0-1014.14
Ubuntu:24.04:LTSlinux-raspi-realtime6.8.0-2019.20, 0
Ubuntu:14.04:LTSlinux3.13.0-8.28, 3.13.0-10.30, 3.13.0-11.31
Ubuntu:16.04:LTSlinux-oem0, 4.13.0-1019.20, 4.13.0-1020.21
Ubuntu:16.04:LTSlinux-snapdragon4.4.0-1020.23, 4.4.0-1022.25, 4.4.0-1024.27
Ubuntu:16.04:LTSlinux-aws4.4.0-1044.53, 0, 4.4.0-1001.10
Ubuntu:20.04:LTSlinux-riscv0, 5.4.0-24.28, 5.4.0-26.30
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.116.11.0-1016.17~24.04.1, 6.11.0-1015.16~24.04.2, 6.11.0-1014.15~24.04.1
Ubuntu:Pro:20.04:LTSlinux-azure-fde-5.155.15.0-1052.60~20.04.1.1, 0, 5.15.0-1019.24~20.04.1.1
Ubuntu:20.04:LTSlinux-raspi25.3.0-1007.8, 5.3.0-1014.16, 5.3.0-1015.17
Ubuntu:14.04:LTSlinux-lts-xenial4.4.0-104.127~14.04.1, 4.4.0-108.131~14.04.1, 4.4.0-109.132~14.04.1
Ubuntu:22.04:LTSlinux-realtime0, 5.15.0-1032.35
Ubuntu:16.04:LTSlinux-hwe4.10.0-33.37~16.04.1, 4.10.0-35.39~16.04.1, 4.10.0-37.41~16.04.1
Ubuntu:24.04:LTSlinux-hwe-6.116.11.0-29.29~24.04.1, 6.11.0-28.28~24.04.1, 6.11.0-26.26~24.04.1
Ubuntu:16.04:LTSlinux-raspi24.4.0-1080.88, 4.4.0-1082.90, 4.4.0-1085.93
Ubuntu:Pro:FIPS:16.04:LTSlinux-fips4.4.0-1003.3, 4.4.0-1005.5, 0
Ubuntu:22.04:LTSlinux-riscv5.15.0-1020.23, 5.15.0-1022.26, 5.15.0-1023.27
Ubuntu:16.04:LTSlinux4.4.0-28.47, 4.4.0-31.50, 4.4.0-34.53
Ubuntu:16.04:LTSlinux-azure4.11.0-1014.14, 4.11.0-1015.15, 4.11.0-1016.16

…and 6 more

Timeline

References

Open in Interactive Console →