CVE-2017-1000112Linux Kernel Heap Buffer Overflow
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch.
Published Oct 5, 2017 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2017-1000112, SUSE-SU-2017:2423-1, SUSE-SU-2017:2424-1, SUSE-SU-2017:2436-1, SUSE-SU-2017:2437-1, SUSE-SU-2017:2438-1, SUSE-SU-2017:2438-2, SUSE-SU-2017:2439-1, SUSE-SU-2017:2440-1, SUSE-SU-2017:2441-1, SUSE-SU-2017:2442-1, SUSE-SU-2017:2443-1, SUSE-SU-2017:2446-1, SUSE-SU-2017:2447-1, SUSE-SU-2017:2448-1, SUSE-SU-2017:2454-1, SUSE-SU-2017:2455-1, SUSE-SU-2017:2456-1, SUSE-SU-2017:2457-1, SUSE-SU-2017:2458-1, SUSE-SU-2017:2464-1, SUSE-SU-2017:2465-1, SUSE-SU-2017:2467-1, SUSE-SU-2017:2469-1, SUSE-SU-2017:2471-1, SUSE-SU-2017:2472-1, SUSE-SU-2017:2473-1, SUSE-SU-2017:2474-1, SUSE-SU-2017:2475-1, SUSE-SU-2017:2476-1, SUSE-SU-2017:2497-1, SUSE-SU-2017:2498-1, SUSE-SU-2017:2499-1, SUSE-SU-2017:2500-1, SUSE-SU-2017:2506-1, SUSE-SU-2017:2508-1, SUSE-SU-2017:2509-1, SUSE-SU-2017:2510-1, SUSE-SU-2017:2511-1, SUSE-SU-2017:2694-1, SUSE-SU-2017:2775-1, SUSE-SU-2017:2791-1, SUSE-SU-2017:2813-1, SUSE-SU-2017:3265-1, UBUNTU-CVE-2017-1000112
Key Facts
Patch immediately- CVE-2017-1000112 is a high-severity vulnerability (CVSS 7.0 v3.1) affecting Linux Kernel, linux (arch), rootio-linux and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 21% probability of exploitation in the next 30 days.
- Fixed versions are available, including cluster-md-kmp-default 4.4.74-92.35.1, cluster-md-kmp-default 4.4.82-6.3.1, cluster-md-kmp-rt 4.4.88-18.1.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
7.0
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
21%
Higher than 97.5% of all scored CVEs
Exploit maturity
Weaponized
ATLAS score
57/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Weaponized
Public exploit code
4
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption.
In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative.
Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005.
Affected Products
602 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Linux KernelLinux | See advisory | 3.10.108 |
| linuxarch | See advisory | 4.13-1 |
| rootio-linuxrootio | See advisory | 4.12.6-1 |
| linux-awsubuntu | See advisory | 4.4.0-1030.39 |
| linux-azure-fdeubuntu | See advisory | n/a |
Patched Releases
cluster-md-kmp-default
4.4.74-92.35.1, 4.4.82-6.3.1
cluster-md-kmp-rt
4.4.88-18.1
cluster-network-kmp-default
4.4.74-92.35.1
cluster-network-kmp-rt
4.4.88-18.1
dlm-kmp-default
4.4.74-92.35.1, 4.4.82-6.3.1
dlm-kmp-rt
4.4.88-18.1
gfs2-kmp-default
4.4.74-92.35.1, 4.4.82-6.3.1
gfs2-kmp-rt
4.4.88-18.1
kernel
0:2.6.18-348.44.1.el5, 0:2.6.32-696.16.1.el6, 0:3.10.0-514.71.1.el7, 2.6.32-696.16.1.el6, 3.10.0-693.5.2.0.1.el7, 3.10.0-693.5.2.el7, 4.9.38-16.35.amzn1
kernel-abi-whitelists
2.6.32-696.16.1.el6, 3.10.0-693.5.2.0.1.el7, 3.10.0-693.5.2.el7
kernel-bigmem
3.0.101-108.18.1
kernel-bigmem-base
3.0.101-108.18.1
kernel-bigmem-devel
3.0.101-108.18.1
kernel-bigsmp
3.0.101-0.47.106.5.1
kernel-bigsmp-base
3.0.101-0.47.106.5.1
kernel-bigsmp-devel
3.0.101-0.47.106.5.1
kernel-debug
2.6.32-696.16.1.el6, 3.10.0-693.5.2.0.1.el7, 3.10.0-693.5.2.el7, 4.4.79-18.26.2, 4.4.79-19.1
kernel-debug-base
4.4.79-18.26.2, 4.4.79-19.1
kernel-debug-devel
2.6.32-696.16.1.el6, 3.10.0-693.5.2.0.1.el7, 3.10.0-693.5.2.el7, 4.4.79-18.26.2, 4.4.79-19.1
kernel-debuginfo-common-i686
4.9.38-16.35.amzn1
kernel-debuginfo-common-x86_64
4.9.38-16.35.amzn1
kernel-default
3.0.101-0.47.106.5.1, 3.0.101-108.18.1, 3.12.61-52.86.1, 3.12.74-60.64.54.1, 4.4.74-92.35.1, 4.4.79-18.26.2, 4.4.79-19.1, 4.4.82-6.3.1
kernel-default-base
3.0.101-0.47.106.5.1, 3.0.101-108.18.1, 3.12.61-52.86.1, 3.12.74-60.64.54.1, 4.4.74-92.35.1, 4.4.79-18.26.2, 4.4.79-19.1, 4.4.82-6.3.1
kernel-default-devel
3.0.101-0.47.106.5.1, 3.0.101-108.18.1, 3.12.61-52.86.1, 3.12.74-60.64.54.1, 4.4.74-92.35.1, 4.4.79-18.26.2, 4.4.79-19.1, 4.4.82-6.3.1
kernel-default-extra
4.4.74-92.35.1, 4.4.82-6.3.1
Timeline
Publicly disclosed
Oct 5, 2017
Last updated
Aug 4, 2026
Weakness Type
- CWE-122 Heap-based Buffer Overflow
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
References
- advisorygithub.com · CVE-2017-1000112
- advisorysecurity-tracker.debian.org · CVE-2017-1000112
- advisoryubuntu.com · CVE-2017-1000112
- advisorycve.org · CVERecord
- advisoryRHSA-2017:2918
FAQ
Common Questions.
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch.
Affected: Linux Kernel; linux (arch); rootio-linux, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including cluster-md-kmp-default 4.4.74-92.35.1, cluster-md-kmp-default 4.4.82-6.3.1, cluster-md-kmp-rt 4.4.88-18.1.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2017-1000112 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo