CVE-2017-10810

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-07-04 · updated 2026-06-17
Weakness: CWE-772

Description

Memory leak in the virtio_gpu_object_create function in drivers/gpu/drm/virtio/virtgpu_object.c in the Linux kernel through 4.11.8 allows attackers to cause a denial of service (memory consumption) by triggering object-initialization failures.

Affected products

Debian Linux: 8.0, 9.0
Linux kernel: from 4.2 before 4.4.77; from 4.5 before 4.9.37; from 4.10 before 4.11.10 — fixed in 4.11.10, 4.4.77, 4.9.37

How to fix

Upgrade to a fixed version: Linux kernel 4.11.10, 4.4.77, 4.9.37. Check the vendor advisory for mitigations.

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=385aee965b4e4c36551c362a334378d2985b722a
http://www.debian.org/security/2017/dsa-3927
http://www.securityfocus.com/bid/99433
https://github.com/torvalds/linux/commit/385aee965b4e4c36551c362a334378d2985b722a
https://lkml.org/lkml/2017/4/6/668
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=385aee965b4e4c36551c362a334378d2985b722a
http://www.debian.org/security/2017/dsa-3927
http://www.securityfocus.com/bid/99433
https://github.com/torvalds/linux/commit/385aee965b4e4c36551c362a334378d2985b722a
https://lkml.org/lkml/2017/4/6/668

Get alerted when CVE-2017-10810 or the next vulnerability affects your stack