Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2017-1000408 — Uncontrolled Resource Consumption in Glibc

CWE-400 — Uncontrolled Resource ConsumptionCWE-772 — Missing Release of Resource after Effective Lifetime11 documents9 sources
Severity
7.8HIGHNVD
EPSS
0.8%
top 26.53%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
GNU Glibc
Timeline
PublishedFeb 1
Latest updateMay 13

Description

A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶Debiangnu/glibc< 2.25-5+3
▶NVDgnu/glibc2.1.1

🔴Vulnerability Details

4
GHSA
GHSA-h374-m7g3-c2ww: A memory leak in glibc 2↗2022-05-13
▶
OSV
CVE-2017-1000408: A memory leak in glibc 2↗2018-02-01
▶
CVEList
CVE-2017-1000408: A memory leak in glibc 2↗2018-02-01
▶
OSV
eglibc, glibc vulnerabilities↗2018-01-17
▶

💥Exploits & PoCs

1
Exploit-DB
GNU C Library Dynamic Loader glibc ld.so - Memory Leak / Buffer Overflow↗2017-12-13
▶

📋Vendor Advisories

3
Ubuntu
GNU C Library vulnerabilities↗2018-01-17
▶
Red Hat
glibc: Memory leak reachable via LD_HWCAP_MASK↗2017-12-11
▶
Debian
CVE-2017-1000408: glibc - A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and ampli...↗2017
▶

💬Community

2
Bugzilla
CVE-2017-1000408 CVE-2017-1000409 glibc: various flaws [fedora-all]↗2017-12-12
▶
Bugzilla
CVE-2017-1000408 glibc: Memory leak reachable via LD_HWCAP_MASK↗2017-12-06
▶
CVE-2017-1000408 — Uncontrolled Resource Consumption | cvebase