critical
CVE-2017-18017
kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.5CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Photon OS. Rated lower by Oracle (high), Red Hat (medium), Ubuntu (medium).
Description
The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| Photon OS 1.0 | linux, linux-esx | 4.4.77-1.ph1 |
| Photon OS 2.0 | linux, linux-aws, linux-esx and 1 more | 4.9.53-3.ph2 |
| debian 11 | linux | 4.11.6-1 |
| debian 12 | linux | 4.11.6-1 |
| debian 13 | linux | 4.11.6-1 |
| debian 14 | linux | 4.11.6-1 |
| debian 7 | linux | 3.2.101-1 |
| debian 8 | linux | 3.16.56-1 |
| debian 9 | linux | 4.9.47-1 |
| echo | linux | 4.11.6-1 |
| Oracle Linux 6 | dtrace-modules-3.8.13-118.26.1.el6uek, dtrace-modules-3.8.13-118.29.1.el6uek, kernel and 15 more | 0.4.5-3.el6 and 2 more |
| Oracle Linux 7 | dtrace-modules-3.8.13-118.26.1.el7uek, dtrace-modules-3.8.13-118.29.1.el7uek, kernel and 17 more | 0.4.5-3.el7 and 2 more |
Show all 72 entries from 19 sources
| Source | Package | Fixed in |
|---|---|---|
| Photon OS 1.0 | linux | 4.4.77-1.ph1 |
| Photon OS 1.0 | linux-esx | 4.4.77-1.ph1 |
| Photon OS 2.0 | linux | 4.9.53-3.ph2 |
| Photon OS 2.0 | linux-aws | 4.9.53-3.ph2 |
| Photon OS 2.0 | linux-esx | 4.9.53-3.ph2 |
| Photon OS 2.0 | linux-secure | 4.9.53-3.ph2 |
| debian 11 | linux | 4.11.6-1 |
| debian 12 | linux | 4.11.6-1 |
| debian 13 | linux | 4.11.6-1 |
| debian 14 | linux | 4.11.6-1 |
| debian 7 | linux | 3.2.101-1 |
| debian 8 | linux | 3.16.56-1 |
| debian 9 | linux | 4.9.47-1 |
| echo | linux | 4.11.6-1 |
| Oracle Linux 6 | dtrace-modules-3.8.13-118.26.1.el6uek | 0.4.5-3.el6 |
| Oracle Linux 6 | dtrace-modules-3.8.13-118.29.1.el6uek | 0.4.5-3.el6 |
| Oracle Linux 6 | kernel | 2.6.32-696.28.1.el6 |
| Oracle Linux 6 | kernel-abi-whitelists | 2.6.32-696.28.1.el6 |
| Oracle Linux 6 | kernel-debug | 2.6.32-696.28.1.el6 |
| Oracle Linux 6 | kernel-debug-devel | 2.6.32-696.28.1.el6 |
| Oracle Linux 6 | kernel-devel | 2.6.32-696.28.1.el6 |
| Oracle Linux 6 | kernel-doc | 2.6.32-696.28.1.el6 |
| Oracle Linux 6 | kernel-firmware | 2.6.32-696.28.1.el6 |
| Oracle Linux 6 | kernel-headers | 2.6.32-696.28.1.el6 |
| Oracle Linux 6 | kernel-uek | 4.1.12-124.17.1.el6uek |
| Oracle Linux 6 | kernel-uek-debug | 4.1.12-124.17.1.el6uek |
| Oracle Linux 6 | kernel-uek-debug-devel | 4.1.12-124.17.1.el6uek |
| Oracle Linux 6 | kernel-uek-devel | 4.1.12-124.17.1.el6uek |
| Oracle Linux 6 | kernel-uek-doc | 4.1.12-124.17.1.el6uek |
| Oracle Linux 6 | kernel-uek-firmware | 4.1.12-124.17.1.el6uek |
| Oracle Linux 6 | perf | 2.6.32-696.28.1.el6 |
| Oracle Linux 6 | python-perf | 2.6.32-696.28.1.el6 |
| Oracle Linux 7 | dtrace-modules-3.8.13-118.26.1.el7uek | 0.4.5-3.el7 |
| Oracle Linux 7 | dtrace-modules-3.8.13-118.29.1.el7uek | 0.4.5-3.el7 |
| Oracle Linux 7 | kernel | 3.10.0-862.el7 |
| Oracle Linux 7 | kernel-abi-whitelists | 3.10.0-862.el7 |
| Oracle Linux 7 | kernel-debug | 3.10.0-862.el7 |
| Oracle Linux 7 | kernel-debug-devel | 3.10.0-862.el7 |
| Oracle Linux 7 | kernel-devel | 3.10.0-862.el7 |
| Oracle Linux 7 | kernel-doc | 3.10.0-862.el7 |
| Oracle Linux 7 | kernel-headers | 3.10.0-862.el7 |
| Oracle Linux 7 | kernel-tools | 3.10.0-862.el7 |
| Oracle Linux 7 | kernel-tools-libs | 3.10.0-862.el7 |
| Oracle Linux 7 | kernel-tools-libs-devel | 3.10.0-862.el7 |
| Oracle Linux 7 | kernel-uek | 4.1.12-124.17.1.el7uek |
| Oracle Linux 7 | kernel-uek-debug | 4.1.12-124.17.1.el7uek |
| Oracle Linux 7 | kernel-uek-debug-devel | 4.1.12-124.17.1.el7uek |
| Oracle Linux 7 | kernel-uek-devel | 4.1.12-124.17.1.el7uek |
| Oracle Linux 7 | kernel-uek-doc | 4.1.12-124.17.1.el7uek |
| Oracle Linux 7 | kernel-uek-firmware | 4.1.12-124.17.1.el7uek |
| Oracle Linux 7 | perf | 3.10.0-862.el7 |
| Oracle Linux 7 | python-perf | 3.10.0-862.el7 |
| root.io debian 11 | rootio-linux | 4.11.6-1 |
| root.io debian 12 | rootio-linux | 4.11.6-1 |
| root.io debian 13 | rootio-linux | 4.11.6-1 |
| ubuntu 14.04 | linux | 3.13.0-142.191 |
| ubuntu 14.04 | linux-lts-xenial | 4.4.0-89.112~14.04.1 |
| ubuntu 14.04-ESM | linux | 3.13.0-142.191 |
| ubuntu 14.04-ESM | linux-lts-xenial | 4.4.0-89.112~14.04.1 |
| ubuntu 16.04 | linux | 4.4.0-89.112 |
| ubuntu 16.04 | linux-aws | 4.4.0-1028.37 |
| ubuntu 16.04 | linux-gcp | 4.13.0-1002.5 |
| ubuntu 16.04 | linux-gke | 4.4.0-1024.24 |
| ubuntu 16.04 | linux-hwe | 4.13.0-32.35~16.04.1 |
| ubuntu 16.04 | linux-hwe-edge | 4.13.0-26.29~16.04.2 |
| ubuntu 16.04 | linux-raspi2 | 4.4.0-1067.75 |
| ubuntu 16.04 | linux-snapdragon | 4.4.0-1069.74 |
| ubuntu 16.04-ESM | linux | 4.4.0-89.112 |
| ubuntu 16.04-ESM | linux-aws | 4.4.0-1028.37 |
| ubuntu 16.04-ESM | linux-gcp | 4.13.0-1002.5 |
| ubuntu 16.04-ESM | linux-hwe | 4.13.0-32.35~16.04.1 |
| ubuntu 16.04-ESM | linux-hwe-edge | 4.13.0-26.29~16.04.2 |
References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2638fd0f92d4397884fd991d8f4925cb3f081901
- http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00038.html
- http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00047.html
- http://lists.opensuse.org/opensuse-security-announce/2018-03/msg00030.html
- http://lists.opensuse.org/opensuse-security-announce/2018-03/msg00067.html
All 40 references
- http://lists.opensuse.org/opensuse-security-announce/2018-03/msg00070.html
- http://lists.opensuse.org/opensuse-security-announce/2018-03/msg00072.html
- http://lists.opensuse.org/opensuse-security-announce/2018-04/msg00014.html
- http://patchwork.ozlabs.org/patch/746618/
- http://www.securityfocus.com/bid/102367
- http://www.ubuntu.com/usn/USN-3583-1
- http://www.ubuntu.com/usn/USN-3583-2
- https://access.redhat.com/errata/RHSA-2018:0676
- https://access.redhat.com/errata/RHSA-2018:1062
- https://access.redhat.com/errata/RHSA-2018:1130
- https://access.redhat.com/errata/RHSA-2018:1170
- https://access.redhat.com/errata/RHSA-2018:1319
- https://access.redhat.com/errata/RHSA-2018:1737
- https://access.redhat.com/security/cve/CVE-2017-18017
- https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1739765
- https://github.com/torvalds/linux/commit/2638fd0f92d4397884fd991d8f4925cb3f081901
- https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
- https://linux.oracle.com/cve/CVE-2017-18017.html
- https://linux.oracle.com/errata/ELSA-2019-4316.html
- https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html
- https://lkml.org/lkml/2017/4/2/13
- https://nvd.nist.gov/vuln/detail/CVE-2017-18017
- https://security.netapp.com/advisory/ntap-20250103-0010/
- https://support.f5.com/csp/article/K18352029
- https://ubuntu.com/security/notices/USN-3583-1
- https://ubuntu.com/security/notices/USN-3583-2
- https://usn.ubuntu.com/3583-1/
- https://usn.ubuntu.com/3583-2/
- https://www.arista.com/en/support/advisories-notices/security-advisories/4577-security-advisory-34
- https://www.cve.org/CVERecord?id=CVE-2017-18017
- https://www.debian.org/security/2018/dsa-4187
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.36