CVE-2017-7477

What it actually does

Heap-based buffer overflow in skb_to_sgvec triggered by oversized skb fragments when NETIF_F_FRAGLIST is enabled in the MACsec driver.

Why it matters to the business

Local attackers can crash affected Linux systems or potentially execute arbitrary code with kernel privileges, leading to service disruption or full host compromise on unpatched systems still running vulnerable kernels.

How an attack unfolds

An authenticated local user crafts or manipulates network traffic that exercises the MACsec module with the NETIF_F_FRAGLIST feature enabled, causing the kernel to allocate an skb with MAX_SKB_FRAGS+1 fragments and overflow the scatter-gather vector.

How to fix it

Upgrade to a fixed kernel version such as 4.12.6-1 (Debian), 3.13.0-128.177 or 4.4.0-91.114 (Ubuntu 14.04/16.04 variants), or later releases that correct the fragment count handling in drivers/net/macsec.c.

How to confirm the fix worked

Verify running kernel version is at or above the listed fixed releases; confirm absence of the vulnerable skb fragment logic by inspecting the macsec driver source or running distribution-specific package checks.

Typical attack path

1. Obtain local shell on target system
2. Enable or trigger MACsec interface with fragment list feature
3. Send or force skb construction exceeding fragment limit
4. Trigger skb_to_sgvec to perform out-of-bounds write
5. Achieve denial of service or attempt privilege escalation

How to detect it

Review kernel logs for MACsec-related oops or skb corruption messages; correlate with local user activity around network interface configuration changes on unpatched systems.

What your security team should do

• Prioritize kernel upgrades on all systems exposing MACsec or using affected Ubuntu/Debian releases
• Restrict local user access on legacy systems until patched
• Monitor for new kernel updates and apply within standard change windows