CVE-2017-17450

CVSS v3.0 7.8 (High)

CVSS v2.0 4.6 (Medium)

EPSS 0.04 % (11^th)

Affected Products 1

Advisories 46

net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allows local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces.

Weaknesses

CWE-862: Missing Authorization

CVE Status: PUBLISHED
CNA: MITRE
Published Date: 2017-12-07 00:29:00
(6 years ago)
Updated Date: 2019-10-03 00:03:26
(5 years ago)

Affected Products

Linux

Linux Kernel

Configuration #1

		CPE23	From	Up To
	Linux Kernel 4.14.4 and prior versions	cpe:2.3:o:linux:linux_kernel		<= 4.14.4