DNA View

High Severity Vulnerability

This vulnerability has been rated as High severity. Immediate action is recommended.

CVE-2017-17805

High

Low Medium High Critical

7.8

CVSS Score

Published: Dec 20, 2017

Last Modified: Apr 20, 2025

CWE: CWE-20

Vulnerability Description

The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable.

CVSS Metrics

Common Vulnerability Scoring System

Vector String:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Known Affected Software

12 configuration(s) from 5 vendor(s)

ubuntu_linux

Version:

14.04

CPE:

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

ubuntu_linux

Version:

16.04

CPE:

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:*:*:*:*

ubuntu_linux

Version:

12.04

CPE:

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*

ubuntu_linux

Version:

17.10

CPE:

cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:lts:*:*:*

debian_linux

Version:

8.0

CPE:

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

debian_linux

Version:

9.0

CPE:

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

leap

Version:

42.2

CPE:

cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*

leap

Version:

42.3

CPE:

cpe:2.3:o:opensuse_project:leap:42.3:*:*:*:*:*:*:*

linux_enterprise_server

Version:

CPE:

cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:-:*:*:*

linux_enterprise_server

Version:

CPE:

cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:-:*:*:*

linux_enterprise_server_for_raspberry_pi

Version:

CPE:

cpe:2.3:o:suse:linux_enterprise_server_for_raspberry_pi:12:sp2:*:*:*:*:*:*

linux_enterprise_desktop

Version:

CPE:

cpe:2.3:o:suse:linux_enterprise_desktop:12:sp4:*:*:*:*:*:*

This vulnerability affects 12 software configuration(s). Ensure you patch all affected systems.

References & Resources

Severity Details

7.8

out of 10.0

High

Weakness Type (CWE)

CWE-20 Top 25 #14

Improper Input Validation

Description: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Exploit Likelihood: High
Typical Severity: High
Abstraction Level: Class