The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker…

Description

The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable.

Scores

EPSS (exploitation in 30 days)

0.44% · top 61% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

• n/a
• CWE-20 (opens in a new tab)All about CWE-20 and its CVEs

Affected products

• n/a

  • affected n/a

References (24)

• RHSA-2018:3083 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• USN-3617-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• USN-3619-2 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• DSA-4082 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• USN-3617-3 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• [debian-lts-announce] 20180107 [SECURITY] [DLA 1232-1] linux security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• SUSE-SU-2018:0012 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• SUSE-SU-2018:0011 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• USN-3632-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• USN-3620-2 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• openSUSE-SU-2018:0022 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• 102291 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• RHSA-2018:2948 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.8 (opens in a new tab)x_refsource_CONFIRMx_transferred
• SUSE-SU-2018:0010 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• DSA-4073 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ecaaab5649781c5a0effdaf298a925063020500e (opens in a new tab)x_refsource_CONFIRMx_transferred
• USN-3617-2 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• https://github.com/torvalds/linux/commit/ecaaab5649781c5a0effdaf298a925063020500e (opens in a new tab)x_refsource_CONFIRMx_transferred
• USN-3620-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• RHSA-2018:3096 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• USN-3619-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• openSUSE-SU-2018:0023 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• RHSA-2019:2473 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2017-17805](https://trackcve.app/badge/CVE-2017-17805.svg)](https://trackcve.app/cve/CVE-2017-17805)

Record last updated 5 Aug 2024, 20:59 UTC.