CVE-2017-17806

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-12-20 · updated 2026-06-17
Weakness: CWE-787

Description

The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.

Affected products

Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 17.10
Debian Linux: 8.0, 9.0
Linux kernel: before 3.2.97; from 3.3 before 3.16.52; from 3.17 before 3.18.89; from 3.19 before 4.1.49; from 4.2 before 4.4.107; from 4.5 before 4.9.71 — fixed in 3.16.52, 3.18.89, 3.2.97, 4.1.49, 4.14.8, 4.4.107
openSUSE Leap: 42.2
Opensuse Project Leap: 42.3
SUSE Linux Enterprise Server 15 SP1: 12-sp2, 12-sp3
SUSE Linux Enterprise Server: 11-extra, 11-sp4, 12-sp2, 12-sp3
SUSE Linux Enterprise Server For Raspberry Pi: 12-sp2

How to fix

Upgrade to a fixed version: Linux kernel 3.16.52, 3.18.89, 3.2.97, 4.1.49. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-17806 or the next vulnerability affects your stack