CVE-2017-8066
published 2017-04-23CVE-2017-8066: drivers/net/can/usb/gs_usb.c in the Linux kernel 4.9.x and 4.10.x before 4.10.2 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local…
PriorityP432high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EPSS
0.43%
35.3th percentile
drivers/net/can/usb/gs_usb.c in the Linux kernel 4.9.x and 4.10.x before 4.10.2 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.9.16-1 (bookworm) | linux 4.9.16-1 (bookworm) |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 4.9.16-1 | 4.9.16-1 |
| linux | linux_kernel | >= 0 < 4.9.16-1 | 4.9.16-1 |
| linux | linux_kernel | >= 0 < 4.9.16-1 | 4.9.16-1 |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qjv7-pwwh-5qqj: drivers/net/can/usb/gs_usb
ghsa_unreviewed·2022-05-17
CVE-2017-8066 [HIGH] CWE-119 GHSA-qjv7-pwwh-5qqj: drivers/net/can/usb/gs_usb
drivers/net/can/usb/gs_usb.c in the Linux kernel 4.9.x and 4.10.x before 4.10.2 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
OSV
CVE-2017-8066: drivers/net/can/usb/gs_usb
osv·2017-04-23·CVSS 7.8
CVE-2017-8066 [HIGH] CVE-2017-8066: drivers/net/can/usb/gs_usb
drivers/net/can/usb/gs_usb.c in the Linux kernel 4.9.x and 4.10.x before 4.10.2 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
Red Hat
kernel: gs_usb.c interacts incorrectly with the CONFIG_VMAP_STACK option
vendor_redhat·2017-02-24·CVSS 7.8
CVE-2017-8066 [HIGH] kernel: gs_usb.c interacts incorrectly with the CONFIG_VMAP_STACK option
kernel: gs_usb.c interacts incorrectly with the CONFIG_VMAP_STACK option
drivers/net/can/usb/gs_usb.c in the Linux kernel 4.9.x and 4.10.x before 4.10.2 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: realtime-kernel (Red Hat Enterprise MRG 2) - Not affected
Debian
CVE-2017-8066: linux - drivers/net/can/usb/gs_usb.c in the Linux kernel 4.9.x and 4.10.x before 4.10.2 ...
vendor_debian·2017·CVSS 7.8
CVE-2017-8066 [HIGH] CVE-2017-8066: linux - drivers/net/can/usb/gs_usb.c in the Linux kernel 4.9.x and 4.10.x before 4.10.2 ...
drivers/net/can/usb/gs_usb.c in the Linux kernel 4.9.x and 4.10.x before 4.10.2 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
Scope: local
bookworm: resolved (fixed in 4.9.16-1)
bullseye: resolved (fixed in 4.9.16-1)
forky: resolved (fixed in 4.9.16-1)
sid: resolved (fixed in 4.9.16-1)
trixie: resolved (fixed in 4.9.16-1)
No detection rules found.
No public exploits indexed.
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.2http://www.openwall.com/lists/oss-security/2017/04/16/4http://www.securityfocus.com/bid/97992https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c919a3069c775c1c876bec55e00b2305d5125caahttps://github.com/torvalds/linux/commit/c919a3069c775c1c876bec55e00b2305d5125caahttp://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.2http://www.openwall.com/lists/oss-security/2017/04/16/4http://www.securityfocus.com/bid/97992https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c919a3069c775c1c876bec55e00b2305d5125caahttps://github.com/torvalds/linux/commit/c919a3069c775c1c876bec55e00b2305d5125caa
2017-04-23
Published