CVE-2017-16996
published 2017-12-27CVE-2017-16996: kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other…
PriorityP432high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.40%
32.5th percentile
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging register truncation mishandling.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 4.14.7-1 (bookworm) | linux 4.14.7-1 (bookworm) |
| linux | linux_kernel | >= 0 < 4.14.7-1 | 4.14.7-1 |
| linux | linux_kernel | >= 0 < 4.14.7-1 | 4.14.7-1 |
| linux | linux_kernel | >= 0 < 4.14.7-1 | 4.14.7-1 |
| linux | linux_kernel | >= 0 < 4.14.7-1 | 4.14.7-1 |
| linux | linux_kernel | >= 4.14 < 4.14.9 | 4.14.9 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: memory corruption caused by BPF verifier bugs can allow for arbitrary code execution
vendor_redhat·2017-12-22·CVSS 7.8
CVE-2017-16996 [HIGH] CWE-787 kernel: memory corruption caused by BPF verifier bugs can allow for arbitrary code execution
kernel: memory corruption caused by BPF verifier bugs can allow for arbitrary code execution
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging register truncation mishandling.
An arbitrary memory r/w access issue was found in the Linux kernel compiled with the eBPF bpf(2) system call (CONFIG_BPF_SYSCALL) support. The issue could occur due to calculation errors in the eBPF verifier module, triggered by user supplied malicious BPF program. An unprivileged user could use this flaw to escalate their privileges on a system. Setting parameter "kernel.unprivileged_bpf_disabled=1" prevents such privilege escalation by restricting access to bpf(2) call.
Statement: Th
Debian
CVE-2017-16996: linux - kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to c...
vendor_debian·2017·CVSS 7.8
CVE-2017-16996 [HIGH] CVE-2017-16996: linux - kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to c...
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging register truncation mishandling.
Scope: local
bookworm: resolved (fixed in 4.14.7-1)
bullseye: resolved (fixed in 4.14.7-1)
forky: resolved (fixed in 4.14.7-1)
sid: resolved (fixed in 4.14.7-1)
trixie: resolved (fixed in 4.14.7-1)
GHSA
GHSA-fhr3-fj6p-xhpf: kernel/bpf/verifier
ghsa_unreviewed·2022-05-14
CVE-2017-16996 [HIGH] CWE-119 GHSA-fhr3-fj6p-xhpf: kernel/bpf/verifier
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging register truncation mishandling.
OSV
CVE-2017-16996: kernel/bpf/verifier
osv·2017-12-27·CVSS 7.8
CVE-2017-16996 [HIGH] CVE-2017-16996: kernel/bpf/verifier
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging register truncation mishandling.
Kernel
bpf: fix incorrect tracking of register size truncation
kernel_security·2017-12-18·CVSS 7.8
CVE-2017-16996 [HIGH] bpf: fix incorrect tracking of register size truncation
bpf: fix incorrect tracking of register size truncation
Properly handle register truncation to a smaller size.
The old code first mirrors the clearing of the high 32 bits in the bitwise
tristate representation, which is correct. But then, it computes the new
arithmetic bounds as the intersection between the old arithmetic bounds and
the bounds resulting from the bitwise tristate representation. Therefore,
when coerce_reg_to_32() is called on a number with bounds
[0xffff'fff8, 0x1'0000'0007], the verifier computes
[0xffff'fff8, 0xffff'ffff] as bounds of the truncated number.
This is incorrect: The truncated number could also be in the range [0, 7],
and no meaningful arithmetic bounds can be computed in that case apart from
the obvious [0, 0xffff'ffff].
Starting with v4.14, this is exploi
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-16996 kernel: memory corruption caused by BPF verifier bugs can allow for arbitrary code execution [fedora-all]
bugzilla·2017-12-22·CVSS 7.8
CVE-2017-16996 [HIGH] CVE-2017-16996 kernel: memory corruption caused by BPF verifier bugs can allow for arbitrary code execution [fedora-all]
CVE-2017-16996 kernel: memory corruption caused by BPF verifier bugs can allow for arbitrary code execution [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: thi
Bugzilla
CVE-2017-16996 kernel: memory corruption caused by BPF verifier bugs can allow for arbitrary code execution
bugzilla·2017-12-22·CVSS 7.8
CVE-2017-16996 [HIGH] CVE-2017-16996 kernel: memory corruption caused by BPF verifier bugs can allow for arbitrary code execution
CVE-2017-16996 kernel: memory corruption caused by BPF verifier bugs can allow for arbitrary code execution
Linux kernel built with the eBPF bpf(2) system call(CONFIG_BPF_SYSCALL) support
is vulnerable to an arbitrary memory r/w access issue. It could occur if a user supplied a malicious BPF program which results calculations error in eBPF verifier module.
An unprivileged user could use this flaw to escalate their privileges on a system.
Upstream patch
-> https://git.kernel.org/linus/3db9128fcf02dcaafa3860a69a8a55d5529b6e30
References:
-> http://seclists.org/oss-sec/2017/q4/429
-> http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16996
-> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16996
-> https://bugs.chromium.org/p/project-zero/issues/detail?id=1454
Mitigation:
#
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0c17d1d2c61936401f4702e1846e2c19b200f958http://openwall.com/lists/oss-security/2017/12/21/2http://www.securityfocus.com/bid/102267https://bugs.chromium.org/p/project-zero/issues/detail?id=1454https://github.com/torvalds/linux/commit/0c17d1d2c61936401f4702e1846e2c19b200f958http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0c17d1d2c61936401f4702e1846e2c19b200f958http://openwall.com/lists/oss-security/2017/12/21/2http://www.securityfocus.com/bid/102267https://bugs.chromium.org/p/project-zero/issues/detail?id=1454https://github.com/torvalds/linux/commit/0c17d1d2c61936401f4702e1846e2c19b200f958
2017-12-27
Published