---

CVE-2017-17806 - log back

CVE-2017-17806 created at 25 Sep 2019 19:31:40
Severity	+ Medium
Remote	+ Local
Type	+ Denial of service
Description	+ The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8, 4.9.71, 4.4.107, 3.18.89, 3.16.52 and 3.2.97 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.
References	+ https://git.kernel.org/linus/af3ff8045bbf3e32f1a448542e73abb4c8ceb6f1
Notes