A member of BackBox community brought to our attention the existence of CVE-2017-7397 asking if it were an actual vulnerability.
Short answer: No, it’s not.
Long answer: Here follows our analysis.
We started by taking a look at CVE requirements for new CVE submissions (http://cve.mitre.org/cve/request_id.html).
We noticed that CVE registration requires that the vendor should be notified of the issue raised. Yet, no one, neither the author of the exploit (FarazPajohan https://www.exploit-db.com/author/?a=8879) nor the person who claims to have exploited the system (Hosein Askari), did attempt to get in touch with us in relation to this discovery.
Having found his personal email, we approached Hosein Askari, the person who claimed to have exploited the system, asking him to prove what he stated in the CVE. So far, we haven’t heard back from him.
Said that, our team has worked to test the exploit in order to confirm whether the statement published at the following link were true or false:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7397
Having clear in mind that our first and only interest is to test the CVE, we set up our target virtual machine running BackBox Linux v4.6 (the “vulnerable” version, according to the CVE), ready to perform all kind of tests to be sure that we leave no blank spaces.
On the attacker’s side, we downloaded the exploit from https://www.exploit-db.com/exploits/41781/ and compiled it with gcc. Once we got the binary, we executed the exploit against the target VM.
In the meanwhile, we monitored the health status of the target. The target VM didn’t feel the CPU consumption claimed in the CVE, rather it was in quite a healthy state.
We have performed several additional tests, both on BackBox 4.6 and the latest stable release 4.7. The result was absolutely negative: the system did not suffer any impairment, no crash occured and no anomalies in the CPU consumption/usage were detected.
Given our results, we have opened a dispute with Mitre (which you can find in the CVE page now) to declare the author’s statement to be untrue, with no foundations and no proof of concept. Moreover, the author even recycled an old exploit, which can be found here: https://www.exploit-db.com/exploits/41350/
Reading his description of the CVE, he refers to RFC1812 section 5.3.7. However, taking a look at RFC1812 section 5.3.7, it is specifically about routers. Below a snippet from the Introduction of https://tools.ietf.org/html/rfc1812 :
[...]
This memo defines and discusses requirements for devices that perform
the network layer forwarding function of the Internet protocol suite.
The Internet community usually refers to such devices as IP routers or
simply routers;
[...]
In conclusion, we state that the CVE-2017-7397 is completely false and based on imaginary assumptions, without any proof of concept. We have asked MITRE to revoke this CVE, marking it as false record.
We would like to invite anyone, including the author, to prove us otherwise. Also, we remind everyone that we are a Free Open Source Software Community and as such we will be delighted if someone will report us bugs and/or vulnerabilities on our system. In the end, this is what a community is made for.
Happy Hacking!
