CVE-2017-17806 - CVE House

Back to Database

Status published High CVE-2017-17806

The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8...

7.8 CVSS

Vulnerability Description

The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-17806

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from linux

View All →

An issue was discovered in drivers/input/input.c in the Linux kernel...

An issue was discovered in the Linux kernel before 6.2....

In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid...

In the Linux kernel before 6.1.3, fs/ntfs3/inode.c does not validate...

In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate...

Affected Vendor

linux

View all reports →

Affected Software

linux kernel, debian linux, leap, linux enterprise desktop, linux enterprise server, linux enterprise server for raspberry pi, ubuntu linux

Vulnerable Versions:

0, 3.3, 3.17, 3.19, 4.2, 4.5, 4.10, 8.0, 9.0, 42.2, 42.3, 12, 11, 12.04, 14.04, 16.04, 17.10

Timeline

Official Publish: December 20th, 2017

Last Modified: August 5th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.