CVE-2017-7187

What it actually does

Local stack-based buffer overflow in the SCSI generic driver (sg_ioctl/sg_write) triggered by an oversized SG_NEXT_CMD_LEN ioctl argument, enabling out-of-bounds writes on the kernel stack.

Why it matters to the business

Local attackers on affected Linux systems can crash servers or potentially execute code, leading to service outages, data integrity issues, or full host compromise; high prevalence in servers and containers increases exposure across fleets.

How an attack unfolds

An attacker with local shell access crafts a malicious SG_NEXT_CMD_LEN ioctl call with an oversized command length, causing the kernel to perform an out-of-bounds write during sg_write processing and either crash the system or hijack control flow.

How to fix it

Upgrade the Linux kernel to a version containing the fix for this buffer handling flaw (post-4.10.4); apply vendor-supplied kernel updates and reboot affected systems.

How to confirm the fix worked

Confirm kernel version is newer than 4.10.4 and that the sg.c ioctl length validation is present; recompile or run regression tests exercising SG_NEXT_CMD_LEN with large values to verify no overflow occurs.

Typical attack path

1. Obtain local unprivileged shell on target Linux host
2. Open /dev/sg* or equivalent SCSI generic device
3. Invoke SG_NEXT_CMD_LEN ioctl with command size exceeding allocated buffer
4. Trigger out-of-bounds write in sg_write to corrupt stack or gain elevated privileges

How to detect it

Review kernel logs and auditd records for unusual ioctl calls on /dev/sg* devices or unexpected crashes in the sg driver; correlate with local user activity preceding the event.

What your security team should do

• Prioritize kernel upgrades on all internet-facing and multi-tenant Linux systems within 30 days
• Restrict unprivileged access to SCSI generic devices via udev rules or LSM policies
• Enable kernel hardening features such as stack canaries and SMEP where supported
• Monitor for local privilege-escalation attempts in system logs