CVE-2017-16996 is a memory corruption vulnerability in the Linux kernel, specifically within the BPF verifier component (kernel/bpf/verifier.c) affecting versions up to 4.14.8, including Debian and other Linux distributions. This flaw allows a local attacker to trigger a denial of service or potentially achieve other unspecified impacts due to mishandling of register truncation. The vulnerability carries a CVSS v3.1 score of 7.8 (High), indicating a high severity. It is a local attack (AV:L) with low attack complexity (AC:L) and requires low privileges (PR:L), meaning an authenticated local user can exploit it to cause high impact to confidentiality, integrity, and availability (C:H/I:H/A:H). There is no known active exploitation of this vulnerability, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Furthermore, there is minimal community discussion or media coverage surrounding this CVE, suggesting it has not garnered significant attention from researchers or attackers.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.14, < 4.14.9CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.