What’s Vulnerable › Vulnerabilities

CVE-2017-5897

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-03-23 · updated 2026-06-17
• Weakness: CWE-125

Description

The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access.

Affected products

• Canonical Ubuntu Linux: 14.04
• Debian Linux: 8.0
• Linux kernel: from 3.7 before 3.10.106; from 3.11 before 3.12.71; from 3.13 before 3.16.41; from 3.17 before 3.18.49; from 3.19 before 4.4.50; from 4.5 before 4.9.11 — fixed in 3.10.106, 3.12.71, 3.16.41, 3.18.49, 4.4.50, 4.9.11

How to fix

Upgrade to a fixed version: Linux kernel 3.10.106, 3.12.71, 3.16.41, 3.18.49. Check the vendor advisory for mitigations.

References

• http://www.debian.org/security/2017/dsa-3791
• http://www.openwall.com/lists/oss-security/2017/02/07/2
• http://www.securityfocus.com/bid/96037
• http://www.securitytracker.com/id/1037794
• https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=7892032cfe67f4bde6fc2ee967e45a8fbaf33756
• https://source.android.com/security/bulletin/2017-09-01
• https://usn.ubuntu.com/3754-1/
• http://www.debian.org/security/2017/dsa-3791
• http://www.openwall.com/lists/oss-security/2017/02/07/2
• http://www.securityfocus.com/bid/96037
• http://www.securitytracker.com/id/1037794
• https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=7892032cfe67f4bde6fc2ee967e45a8fbaf33756

Get alerted when CVE-2017-5897 or the next vulnerability affects your stack