CVE-2017-2636 is a race condition vulnerability in the n_hdlc.c driver of the Linux kernel, affecting versions up to 4.10.1, including Debian distributions. This flaw allows a local attacker to achieve privilege escalation or cause a denial of service through a double free by manipulating the HDLC line discipline. With a CVSS score of 7.0 (HIGH), exploitation requires low privileges and high attack complexity, but can lead to high impact on confidentiality, integrity, and availability. While not listed in CISA's KEV catalog and lacking public Metasploit or ExploitDB modules, there is community discussion indicating potential exploit development, including a Reddit post mentioning bypassing SMEP.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.6.31, < 3.2.87CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 3.3, < 3.10.106CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 3.11, < 3.12.72CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 3.13, < 3.16.42CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 3.17, < 3.18.49CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.4 InfoSec Media, 0.1 Vendor Blog, and 0.0 Security Researcher mentions.