CVE-2017-16995
Estado: ModificadaAlta (7.8)—💥 Exploit
La función check_alu_op en kernel/bpf/verifier.c en el kernel de Linux, hasta la versión 4.4, permite que los usuarios locales provoquen una denegación de servicio (corrupción de memoria) o, posiblemente, causen otros impactos no especificados aprovechando una extensión de señal incorrecta
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 30%
- Percentil entre todas las CVEs puntuadas: 98
- Fecha de la puntuación: 11/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
💥 Exploits públicos
Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.
- Módulo de Metasploit (exploit fiable y al alcance de cualquiera) · Linux BPF Sign Extension Local Privilege Escalation
- Publicado en Exploit-DB · Linux - BPF Sign Extension Local Privilege Escalation (Metasploit) (19/7/2018)
- Publicado en Exploit-DB · Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27) - Local Privilege Escalation (10/7/2018)
- Publicado en Exploit-DB · Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4) - Local Privilege Escalation (16/3/2018)
- Prueba de concepto en GitHub (no verificada) · Lista de pruebas de concepto en GitHub
⚠️ Las pruebas de concepto de GitHub no están verificadas: algunas son falsas o contienen malware. No las ejecute nunca fuera de un laboratorio aislado.
Tecnologías afectadas (3)
CWE
- CWE-119
Referencias
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f
- http://openwall.com/lists/oss-security/2017/12/21/2
- http://www.securityfocus.com/bid/102288
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1454
- https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=a6132276ab5dcc38b3299082efeb25b948263adb
- https://github.com/torvalds/linux/commit/95a762e2c8c942780948091f8f2a4f32fce1ac6f
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3633-1/
- https://usn.ubuntu.com/usn/usn-3523-2/
- https://www.debian.org/security/2017/dsa-4073
- https://www.exploit-db.com/exploits/44298/
- https://www.exploit-db.com/exploits/45010/
- https://www.exploit-db.com/exploits/45058/
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f
- http://openwall.com/lists/oss-security/2017/12/21/2
- http://www.securityfocus.com/bid/102288
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1454
- https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=a6132276ab5dcc38b3299082efeb25b948263adb
- https://github.com/torvalds/linux/commit/95a762e2c8c942780948091f8f2a4f32fce1ac6f
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3633-1/
- https://usn.ubuntu.com/usn/usn-3523-2/
- https://www.debian.org/security/2017/dsa-4073
- https://www.exploit-db.com/exploits/44298/
- https://www.exploit-db.com/exploits/45010/
- https://www.exploit-db.com/exploits/45058/
JSON original (NVD)
Mostrar
{
"id": "CVE-2017-16995",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.2,
"accessVector": "LOCAL",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 3.9,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "security@debian.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "through 4.4"
}
]
}
]
}
],
"published": "2017-12-27T17:08:17.670",
"references": [
{
"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f",
"tags": [
"Vendor Advisory"
],
"source": "security@debian.org"
},
{
"url": "http://openwall.com/lists/oss-security/2017/12/21/2",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "security@debian.org"
},
{
"url": "http://www.securityfocus.com/bid/102288",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security@debian.org"
},
{
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1454",
"tags": [
"Third Party Advisory"
],
"source": "security@debian.org"
},
{
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=a6132276ab5dcc38b3299082efeb25b948263adb",
"tags": [
"Vendor Advisory"
],
"source": "security@debian.org"
},
{
"url": "https://github.com/torvalds/linux/commit/95a762e2c8c942780948091f8f2a4f32fce1ac6f",
"tags": [
"Third Party Advisory"
],
"source": "security@debian.org"
},
{
"url": "https://usn.ubuntu.com/3619-1/",
"tags": [
"Third Party Advisory"
],
"source": "security@debian.org"
},
{
"url": "https://usn.ubuntu.com/3619-2/",
"tags": [
"Third Party Advisory"
],
"source": "security@debian.org"
},
{
"url": "https://usn.ubuntu.com/3633-1/",
"tags": [
"Third Party Advisory"
],
"source": "security@debian.org"
},
{
"url": "https://usn.ubuntu.com/usn/usn-3523-2/",
"tags": [
"Third Party Advisory"
],
"source": "security@debian.org"
},
{
"url": "https://www.debian.org/security/2017/dsa-4073",
"tags": [
"Third Party Advisory"
],
"source": "security@debian.org"
},
{
"url": "https://www.exploit-db.com/exploits/44298/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security@debian.org"
},
{
"url": "https://www.exploit-db.com/exploits/45010/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security@debian.org"
},
{
"url": "https://www.exploit-db.com/exploits/45058/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security@debian.org"
},
{
"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://openwall.com/lists/oss-security/2017/12/21/2",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/102288",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1454",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=a6132276ab5dcc38b3299082efeb25b948263adb",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/torvalds/linux/commit/95a762e2c8c942780948091f8f2a4f32fce1ac6f",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://usn.ubuntu.com/3619-1/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://usn.ubuntu.com/3619-2/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://usn.ubuntu.com/3633-1/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://usn.ubuntu.com/usn/usn-3523-2/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2017/dsa-4073",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.exploit-db.com/exploits/44298/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.exploit-db.com/exploits/45010/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.exploit-db.com/exploits/45058/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-119"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension."
},
{
"lang": "es",
"value": "La función check_alu_op en kernel/bpf/verifier.c en el kernel de Linux, hasta la versión 4.4, permite que los usuarios locales provoquen una denegación de servicio (corrupción de memoria) o, posiblemente, causen otros impactos no especificados aprovechando una extensión de señal incorrecta"
}
],
"lastModified": "2026-06-17T01:10:14.097",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8F90DFFB-7662-456E-B026-70B6266F2672",
"versionEndExcluding": "4.9.72",
"versionStartIncluding": "4.9"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "138E3219-AF76-4219-A5E1-8EF8548D50A6",
"versionEndExcluding": "4.14.9",
"versionStartIncluding": "4.10"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
"vulnerable": true,
"matchCriteriaId": "815D70A8-47D3-459C-A32C-9FEACA0659D1"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security@debian.org"
}