CVE-2017-7618

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-04-10 · updated 2026-06-17
Weakness: CWE-835

Description

crypto/ahash.c in the Linux kernel through 4.10.9 allows attackers to cause a denial of service (API operation calling its own callback, and infinite recursion) by triggering EBUSY on a full queue.

Affected products

Linux kernel: from 3.15 before 3.16.44; from 3.17 before 3.18.50; from 3.19 before 4.1.40; from 4.2 before 4.4.63; from 4.5 before 4.9.24; from 4.10 before 4.10.12 — fixed in 3.16.44, 3.18.50, 4.1.40, 4.10.12, 4.4.63, 4.9.24

How to fix

Upgrade to a fixed version: Linux kernel 3.16.44, 3.18.50, 4.1.40, 4.10.12. Check the vendor advisory for mitigations.

References

http://marc.info/?l=linux-crypto-vger&m=149181655623850&w=2
http://www.securityfocus.com/bid/97534
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03800en_us
http://marc.info/?l=linux-crypto-vger&m=149181655623850&w=2
http://www.securityfocus.com/bid/97534
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03800en_us

Get alerted when CVE-2017-7618 or the next vulnerability affects your stack