peter bassill · operator
$ cve CVE-2017-1000251 JSON

CVE-2017-1000251 EXPLOIT

8.0
HIGH · CVSS 3.1 · EPSS 16.2% (pctl 97)

Patch early

A public exploit exists.

Description

The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space.

Scoring

CVSS8.0 (HIGH, v3.1)
VectorCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS16.18% — more likely to be exploited than 97% of all CVEs
WeaknessCWE-787
On CISA KEVno
Public exploityes
Published2017-09-12
Last modified2026-06-17

Affected (10)

VendorProduct
debiandebian linux
linuxlinux kernel
nvidiajetson tk1
nvidiajetson tx1
redhatenterprise linux desktop
redhatenterprise linux server
redhatenterprise linux server aus
redhatenterprise linux server eus
redhatenterprise linux server tus
redhatenterprise linux workstation

Public exploits

SourceTitleDate
exploit-dbLinux Kernel < 4.13.1 - BlueTooth Buffer Overflow (PoC)2017-09-21

References

→ the Explorer  ·  watch your stack  ·  NVD