What’s Vulnerable › Vulnerabilities
CVE-2017-17805
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2017-12-20 · updated 2026-06-17
- Weakness: CWE-20
Description
The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable.
Affected products
- Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 17.10
- Debian Linux: 8.0, 9.0
- Linux kernel: from 2.6.25 before 3.2.97; from 3.3 before 3.16.52; from 3.17 before 3.18.89; from 3.19 before 4.1.49; from 4.2 before 4.4.107; from 4.5 before 4.9.71 — fixed in 3.16.52, 3.18.89, 3.2.97, 4.1.49, 4.14.8, 4.4.107
- openSUSE Leap: 42.2
- Opensuse Project Leap: 42.3
- SUSE Linux Enterprise Server 15 SP1: 12-sp2, 12-sp3
- SUSE Linux Enterprise Server: 11-extra, 11-sp4, 12-sp2, 12-sp3
- SUSE Linux Enterprise Server For Raspberry Pi: 12-sp2
How to fix
Upgrade to a fixed version: Linux kernel 3.16.52, 3.18.89, 3.2.97, 4.1.49. Check the vendor advisory for mitigations.
References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ecaaab5649781c5a0effdaf298a925063020500e
- http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.html
- http://www.securityfocus.com/bid/102291
- https://access.redhat.com/errata/RHSA-2018:2948
- https://access.redhat.com/errata/RHSA-2018:3083
- https://access.redhat.com/errata/RHSA-2018:3096
- https://access.redhat.com/errata/RHSA-2019:2473
- https://github.com/torvalds/linux/commit/ecaaab5649781c5a0effdaf298a925063020500e
Get alerted when CVE-2017-17805 or the next vulnerability affects your stack