Evil-DB LogoEvil-DB
← All CVEs

CVE-2017-7895

critical · 9.8

The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.

9.8
CVSS
10.8%
EPSS (exploit prob.)
96th
EPSS percentile
2017-04-28
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-119

Affected products

VendorProductAffected versions
linuxlinux_kernel< 3.2.89
linuxlinux_kernel>= 3.3, < 3.16.44
linuxlinux_kernel>= 3.17.0, < 4.1.40
linuxlinux_kernel>= 4.2, < 4.4.67
linuxlinux_kernel>= 4.5.0, < 4.9.26
linuxlinux_kernel>= 4.10, < 4.10.14
debiandebian_linux8.0
debiandebian_linux9.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2017-7895