CVE-2017-14106

What it actually does

Local process can trigger a divide-by-zero in __tcp_select_window during a specific tcp_recvmsg disconnect sequence, causing a kernel panic and system crash.

Why it matters to the business

Affected Alpine systems running the vulnerable ruby package can experience unexpected reboots or hangs, leading to service outages and potential data loss for workloads relying on TCP connections; the issue is years old with no signs of active exploitation.

How an attack unfolds

An attacker with local access on a vulnerable Alpine system crafts or triggers a TCP connection that disconnects at a precise point inside tcp_recvmsg, forcing the kernel into the faulty tcp_disconnect path and producing the divide-by-zero crash.

How to fix it

Upgrade the ruby package on Alpine v3.10 to version 2.5.1-r0 or later; apply the update through the distribution package manager and reboot if required to load any kernel-level fixes.

How to confirm the fix worked

Confirm the installed ruby package version is at least 2.5.1-r0 using apk info or equivalent; monitor for absence of the divide-by-zero panic signature after applying the update.

Typical attack path

1. Obtain local shell or process execution on the target Alpine system
2. Establish a TCP connection that will be torn down inside the tcp_recvmsg code path
3. Force the disconnect condition that reaches tcp_disconnect
4. Trigger the divide-by-zero and resulting kernel panic

How to detect it

Inspect kernel logs for __tcp_select_window divide-by-zero panic messages and correlate with processes performing unusual TCP recvmsg operations; no widespread exploitation indicators exist given the CVE's age and low EPSS.

What your security team should do

• Prioritize patching Alpine systems running ruby to 2.5.1-r0 within standard maintenance windows
• Review local user access controls to reduce the attack surface for local DoS issues
• Ensure kernel crash logging is enabled to detect similar panics in the future