CVE-2017-6952: Buffer Overflow in Capstone Disassembler

An attacker exploiting CVE-2017-6952 can trigger a heap-based buffer overflow within the kernel driver when a large value is provided to the cswinkernelmalloc function. This overflow can overwrite adjacent memory regions, potentially leading to a system crash or denial of service. While the description notes the possibility of “unspecified other impact,” the primary and most likely consequence is a DoS. The vulnerability's location within a kernel driver suggests a potentially high impact, as successful exploitation could disrupt core system functionality. The ability to trigger this overflow depends on the attacker's ability to influence the value passed to cswinkernelmalloc, which may require specific interaction with the disassembler or its integration points.

1. Published2017-03-16
2. Modified2024-11-21
3. EPSS updated2026-04-02

The primary mitigation for CVE-2017-6952 is to upgrade to Capstone version 3.0.5rc2 or later, which contains the fix for the integer overflow. If immediate upgrading is not feasible, consider implementing input validation on the value passed to cswinkernelmalloc to prevent excessively large values from being allocated. While a WAF or proxy is unlikely to directly mitigate this kernel-level vulnerability, restricting network access to the disassembler component could reduce the attack surface. After upgrading, confirm the fix by attempting to trigger the overflow with a large value and verifying that the allocation fails gracefully without causing a crash.