CVE-2017-8797

HIGH Year: 2017
CVSS v3 Score
7.5
High
CVSS v2 Score
7.8
High
Weakness Type
CWE-129
View all →

Vulnerability Description

The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This type value is uninitialized upon encountering certain error conditions. This value is used as an array index for dereferencing, which leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the whole system.

Related Vulnerabilities

CVE-2013-1593

HIGH
CVSS:7.5(High)

A Denial of Service vulnerability exists in the WRITE_C function in the msg_server.exe module in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04 when sending a crafted SAP Message Server packe...

CWE-1292013

CVE-2014-10044

HIGH
CVSS:7.5(High)

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, SD 210/SD 212/SD 205, SD 400, SD 617, SD 800, and SD 820, in the time daemon, una...

CWE-1292014

CVE-2017-5445

HIGH
CVSS:7.5(High)

A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to create an array. This could allow the reading of uninitialized memory into the array...

CWE-1292017

CVE-2018-12018

HIGH
CVSS:7.5(High)

The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, wh...

CWE-1292018

CVE-2018-13902

HIGH
CVSS:7.5(High)

Out of bounds memory read and access due to improper array index validation may lead to unexpected behavior while decoding XTRA file in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Sn...

CWE-1292018

CVE-2018-17848

HIGH
CVSS:7.5(High)

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node....

CWE-1292018