CVE-2017-10661

high · 7

Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing.

CVSS

13.4%

EPSS (exploit prob.)

96th

EPSS percentile

2017-08-19

Published

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-416

Affected products

Vendor	Product	Affected versions
linux	linux_kernel	< 3.2.92
linux	linux_kernel	>= 3.3, < 3.16.47
linux	linux_kernel	>= 3.17, < 3.18.52
linux	linux_kernel	>= 3.19, < 4.1.41
linux	linux_kernel	>= 4.2, < 4.4.67
linux	linux_kernel	>= 4.5, < 4.9.27
linux	linux_kernel	>= 4.10, < 4.10.15
redhat	enterprise_linux	7.0
redhat	enterprise_linux_aus	7.4
redhat	enterprise_linux_server_eus	7.5
redhat	enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions	7.4
debian	debian_linux	8.0
debian	debian_linux	9.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2017-10661