NetSight
IP …
high7.8

CVE-2017-17806

The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowi…

Impact

The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
before 3.2.97
from 3.3 before 3.16.52
from 3.17 before 3.18.89
from 3.19 before 4.1.49
from 4.2 before 4.4.107
from 4.5 before 4.9.71
DebianDebian Linux
Versions 8.0, 9.0
OpensuseLeap
Version 42.2
Opensuse ProjectLeap
Version 42.3
SuseLinux Enterprise Desktop
Version 12
SuseLinux Enterprise Server
Versions 11, 12
SuseLinux Enterprise Server For Raspberry Pi
Version 12
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 17.10

Weakness classification

CWE-787

References