Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-7895: Linux kernel NFS server can crash from crafted requests

CVE-2017-7895 · published 9 years ago

Summary

The NFS version 2 and version 3 services built into Linux kernels up to version 4.10.13 do not correctly verify the end of incoming data. An attacker on the network could send specially formed NFS requests that cause the server to misbehave, potentially crashing or behaving unpredictably. Updating to a newer kernel version or disabling NFS v2/v3 eliminates the risk.

What to do

Update canonical linux to version 3.13.0-125.174.
Update canonical linux-lts-xenial to version 4.4.0-79.100~14.04.1.
Update canonical linux to version 4.4.0-79.100.
Update canonical linux-aws to version 4.4.0-1018.27.
Update canonical linux-gke to version 4.4.0-1014.14.
Update canonical linux-hwe to version 4.10.0-32.36~16.04.1.
Update canonical linux-raspi2 to version 4.4.0-1057.64.
Update canonical linux-snapdragon to version 4.4.0-1059.63.
Update debian linux to version 4.9.25-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:14.04:LTS	canonical	linux	< 3.13.0-125.174 Fix: upgrade to 3.13.0-125.174
Ubuntu:14.04:LTS	canonical	linux-lts-xenial	< 4.4.0-79.100~14.04.1 Fix: upgrade to 4.4.0-79.100~14.04.1
Ubuntu:16.04:LTS	canonical	linux	< 4.4.0-79.100 Fix: upgrade to 4.4.0-79.100
Ubuntu:16.04:LTS	canonical	linux-aws	< 4.4.0-1018.27 Fix: upgrade to 4.4.0-1018.27
Ubuntu:16.04:LTS	canonical	linux-gke	< 4.4.0-1014.14 Fix: upgrade to 4.4.0-1014.14
Ubuntu:16.04:LTS	canonical	linux-hwe	< 4.10.0-32.36~16.04.1 Fix: upgrade to 4.10.0-32.36~16.04.1
Ubuntu:16.04:LTS	canonical	linux-raspi2	< 4.4.0-1057.64 Fix: upgrade to 4.4.0-1057.64
Ubuntu:16.04:LTS	canonical	linux-snapdragon	< 4.4.0-1059.63 Fix: upgrade to 4.4.0-1059.63
Ubuntu:18.04:LTS	canonical	linux-azure	All versions
Ubuntu:18.04:LTS	canonical	linux-gcp	All versions
Ubuntu:18.04:LTS	canonical	linux-hwe	All versions
Ubuntu:18.04:LTS	canonical	linux-hwe-edge	All versions
Ubuntu:18.04:LTS	canonical	linux-oem	All versions
Ubuntu:20.04:LTS	canonical	linux-azure-fde	All versions
Ubuntu:Pro:20.04:LTS	canonical	linux-azure-fde-5.15	All versions
Ubuntu:20.04:LTS	canonical	linux-gke	All versions
Ubuntu:20.04:LTS	canonical	linux-raspi2	All versions
Ubuntu:20.04:LTS	canonical	linux-riscv	All versions
Ubuntu:22.04:LTS	canonical	linux-intel-iot-realtime	All versions
Ubuntu:22.04:LTS	canonical	linux-realtime	All versions
Ubuntu:22.04:LTS	canonical	linux-riscv	All versions
Ubuntu:24.04:LTS	canonical	linux-azure-6.11	All versions
Ubuntu:24.04:LTS	canonical	linux-gcp-6.11	All versions
Ubuntu:24.04:LTS	canonical	linux-hwe-6.11	All versions
Ubuntu:24.04:LTS	canonical	linux-lowlatency-hwe-6.11	All versions
Ubuntu:24.04:LTS	canonical	linux-raspi-realtime	All versions
Debian:12	debian	linux	< 4.9.25-1 Fix: upgrade to 4.9.25-1
Debian:13	debian	linux	< 4.9.25-1 Fix: upgrade to 4.9.25-1
Debian:14	debian	linux	< 4.9.25-1 Fix: upgrade to 4.9.25-1
–	linux	linux_kernel	< 3.2.89 >= 3.3, < 3.16.44 >= 3.17.0, < 4.1.40 >= 4.2, < 4.4.67 >= 4.5.0, < 4.9.26 >= 4.10, < 4.10.14 `cpe:2.3:o:linux:linux_kernel::::::::`
–	debian	debian_linux	8.0 9.0 `cpe:2.3:o:debian:debian_linux:8.0:::::::*`

Original advisory text

The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.

References

https://ubuntu.com/security/CVE-2017-7895 Third Party Advisory
https://ubuntu.com/security/notices/USN-3314-1 Vendor Advisory
https://ubuntu.com/security/notices/USN-3312-1 Vendor Advisory
https://ubuntu.com/security/notices/USN-3312-2 Vendor Advisory
https://ubuntu.com/security/notices/USN-3359-1 Vendor Advisory
https://ubuntu.com/security/notices/USN-3361-1 Vendor Advisory
https://ubuntu.com/security/notices/USN-3360-1 Vendor Advisory
https://ubuntu.com/security/notices/USN-3360-2 Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2017-7895 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2017-7895 Vendor Advisory
http://www.debian.org/security/2017/dsa-3886 Third Party Advisory
http://www.securityfocus.com/bid/98085 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2017:1615 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1616 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1647 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1715 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1723 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1766 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1798 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2412 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2428 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2429 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2472 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2732 Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13... Patch Third Party Advisory
https://github.com/torvalds/linux/commit/13bf9fbff0e5e099e2b6f003a0ab8ae14543630... Patch Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

11% chance of attack within 30 days

Type

CWE-119Buffer Overflow

Timeline

Published28 Apr 2017

Updated24 Oct 2026

First seen26 Aug 2026

Sources

UBUNTU-CVE-2017-7895 · OSV

CVE-2017-7895 · NVD

DEBIAN-CVE-2017-7895 · OSV

Track software like this

Free during beta