CVE-2017-17432

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-12-06 · updated 2026-06-17
Weakness: CWE-617

Description

OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application crash) via crafted fields, as demonstrated by an integer underflow and assertion failure for a small MTU value.

Affected products

Debian Linux: 8.0, 9.0
The OpenAFS Foundation OpenAFS: from 1.0 before 1.6.22 — fixed in 1.6.22

How to fix

Upgrade to a fixed version: The OpenAFS Foundation OpenAFS 1.6.22. Check the vendor advisory for mitigations.

References

https://bugs.debian.org/883602
https://lists.debian.org/debian-lts-announce/2017/12/msg00016.html
https://www.debian.org/security/2017/dsa-4067
https://www.openafs.org/pages/security/OPENAFS-SA-2017-001.txt
https://bugs.debian.org/883602
https://lists.debian.org/debian-lts-announce/2017/12/msg00016.html
https://www.debian.org/security/2017/dsa-4067
https://www.openafs.org/pages/security/OPENAFS-SA-2017-001.txt

Get alerted when CVE-2017-17432 or the next vulnerability affects your stack