Medium
Security advisory
Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-11171
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:11 UTC · Revision 1
Source evidence
Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible.
osv:CVE-2017-11171
Complete source record
{
"id": "462fac2639cc7e4d0edeacdcf266a88c549ad3d51d7ff79b044c177d24f6b011",
"url": "https://osv.dev/vulnerability/CVE-2017-11171",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-11171",
"summary": "Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible.",
"evidence": "osv:CVE-2017-11171",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2017-11171",
"aliases": [
"CVE-2017-11171"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/gnome/gnome-session",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "ba19aa1de06ed8faf94fa423c6c04aec548f709b"
},
{
"fixed": "b0dc999e0b45355314616321dbb6cb71e729fc9d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:gnome:gnome-session:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.29.92"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "b0dc999e0b45355314616321dbb6cb71e729fc9d"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"GNOME_SESSION_2_29_6",
"GNOME_SESSION_2_28_0",
"GNOME_SESSION_2_27_92",
"GNOME_SESSION_2_27_91",
"GNOME_SESSION_2_27_5",
"GNOME_SESSION_2_27_4",
"GNOME_SESSION_2_26_1",
"GNOME_SESSION_2_26_0_90",
"GNOME_SESSION_2_26_0",
"GNOME_SESSION_2_25_92",
"GNOME_SESSION_2_25_91",
"GNOME_SESSION_2_25_90",
"GNOME_SESSION_2_25_5",
"GNOME_SESSION_2_25_3",
"GNOME_SESSION_2_25_2",
"GNOME_2_24_BRANCHPOINT",
"GNOME_SESSION_2_24_1",
"GNOME_SESSION_2_24_0",
"GNOME_SESSION_2_23_92",
"GNOME_SESSION_2_23_91",
"GNOME_SESSION_2_23_90",
"GNOME_SESSION_2_23_6",
"GNOME_SESSION_2_23_3",
"GNOME_SESSION_2_23_2_2",
"GNOME_SESSION_2_23_2_1",
"GNOME_SESSION_2_23_2",
"GNOME_SESSION_2_23_1_1",
"GNOME_SESSION_2_23_1",
"GNOME_SESSION_BEFORE_NEW_CODE",
"GNOME_SESSION_2_22_0",
"GNOME_SESSION_2_21_93",
"GNOME_SESSION_2_21_92",
"GNOME_SESSION_2_21_91",
"GNOME_SESSION_2_21_90",
"GNOME_SESSION_2_21_5",
"GNOME_SESSION_2_20_1",
"GNOME_SESSION_2_20_0",
"GNOME_SESSION_2_19_92",
"GNOME_SESSION_2_19_90",
"GNOME_SESSION_2_19_6",
"GNOME_SESSION_2_19_5",
"GNOME_SESSION_2_19_4",
"GNOME_SESSION_2_19_3",
"GNOME_SESSION_2_19_2",
"GNOME_SESSION_2_18_0",
"GNOME_SESSION_2_17_92",
"GNOME_SESSION_2_17_91",
"GNOME_SESSION_2_17_90_1",
"GNOME_SESSION_2_17_90",
"GNOME_SESSION_2_17_5",
"GNOME_SESSION_2_17_3",
"GNOME_2_16_BRANCHPOINT",
"GNOME_SESSION_2_17_2",
"GNOME_SESSION_2_16_1",
"GNOME_SESSION_2_16_0",
"GNOME_SESSION_2_15_92",
"GNOME_SESSION_2_15_91",
"GNOME_SESSION_2_15_90",
"GNOME_SESSION_2_15_4",
"GNOME_2_14_BRANCHPOINT",
"GNOME_SESSION_2_15_1",
"GNOME_SESSION_2_14_1",
"GNOME_SESSION_2_14_0",
"GNOME_SESSION_2_13_92",
"GNOME_SESSION_2_13_91",
"GNOME_SESSION_2_13_90",
"GNOME_SESSION_2_13_5",
"GNOME_SESSION_2_13_4",
"GNOME_2_12_BRANCHPOINT",
"GNOME_SESSION_2_12_0",
"GNOME_SESSION_2_11_91",
"GNOME_SESSION_2_11_90",
"GNOME_SESSION_2_11_1",
"GNOME_2_10_BRANCHPOINT",
"GNOME_SESSION_2_10_0",
"GNOME_SESSION_2_9_4",
"GNOME_SESSION_2_9_2",
"GNOME_2_8_BRANCHPOINT",
"GNOME_SESSION_2_8_1",
"GNOME_SESSION_2_8_0",
"GNOME_SESSION_2_7_92",
"GNOME_SESSION_2_7_91",
"GNOME_SESSION_2_7_4",
"GNOME_SESSION_2_7_3",
"GNOME_2_6_BRANCHPOINT",
"GNOME_SESSION_2_7_1",
"GNOME_SESSION_2_6_1",
"GNOME_SESSION_2_6_0",
"GNOME_SESSION_2_5_92",
"GNOME_DESKTOP_2_5_92",
"GNOME_SESSION_2_5_91",
"GNOME_SESSION_2_5_90",
"GNOME_SESSION_2_5_5",
"GNOME_SESSION_2_5_4",
"GNOME_SESSION_2_5_3",
"GNOME_2_4_BRANCHPOINT",
"GNOME_SESSION_2_5_2",
"GNOME_SESSION_2_5_1",
"GNOME_SESSION_2_4_1",
"GNOME_SESSION_2_4_0",
"GNOME_SESSION_2_3_90",
"GNOME_SESSION_2_3_7",
"GNOME_SESSION_2_3_6_2",
"GNOME_SESSION_2_3_6_1",
"GNOME_SESSION_2_3_6",
"GNOME_SESSION_2_3_4",
"GNOME_SESSION_2_3_3_1",
"GNOME_SESSION_2_3_3",
"GNOME_SESSION_2_3_2",
"GNOME_SESSION_2_3_1",
"GNOME_SESSION_2_3_0",
"PREPARED_2_3_1",
"GNOME_2_2_BRANCHPOINT",
"GNOME_SESSION_2_2_0_2",
"GNOME_SESSION_2_2_0_1",
"GNOME_SESSION_2_2_0",
"GNOME_SESSION_2_1_90",
"GNOME_SESSION_2_1_5",
"GNOME_SESSION_2_1_4",
"GNOME_SESSION_2_1_3",
"GNOME_SESSION_2_1_2",
"GNOME_SESSION_2_1_1",
"GNOME_SESSION_2_1_0",
"GNOME_SESSION_2_0_3",
"GNOME_SESSION_2_0_2",
"GNOME_SESSION_2_0_1",
"GNOME_SESSION_2_0_0",
"GNOME_SESSION_1_5_21",
"GNOME_SESSION_1_5_20",
"GNOME_SESSION_1_5_19",
"GNOME_SESSION_1_5_18",
"GNOME_SESSION_1_5_17",
"GNOME_SESSION_1_5_16",
"GNOME_SESSION_1_5_15",
"GNOME_SESSION_1_5_14",
"GNOME_SESSION_1_5_13",
"GNOME_SESSION_1_5_12",
"GNOME_SESSION_1_5_11",
"GNOME_SESSION_1_5_10",
"GNOME_SESSION_1_5_9",
"GNOME_CORE_MODULE_SPLIT",
"GNOME_CORE_1_5_8",
"GNOME_CORE_1_5_7",
"GNOME_CORE_1_5_6",
"GNOME_CORE_1_5_5",
"GNOME_CORE_1_5_4",
"GNOME_1_5_3",
"GNOME_CORE_1_5_2",
"GNOME_CORE_1_5_1",
"GNOME_CORE_1_4_ANCHOR",
"GNOME_CORE_1_4_0_4",
"GNOME_CORE_1_4_0_3",
"GNOME_CORE_1_4_0_1",
"GNOME_CORE_1_4_0",
"GNOME_CORE_1_3_1",
"GNOME_CORE_1_3_0",
"GNOME_CORE_1_2_99_2",
"GNOME_CORE_1_2_3_1",
"GNOME_PRINT_0_24",
"GNOME_CORE_1_2_2",
"GNOME_CORE_1_2_0",
"GNOME_CORE_1_1_9",
"help",
"GNOME_CORE_1_1_8",
"GNOME_CORE_1_1_6",
"GNOME_CORE_1_1_5",
"GNOME_CORE_1_1_4",
"GNOME_CORE_1_1_3",
"GNOME_CORE_1_1_2",
"GNOME_CORE_1_1_1",
"GNOME_CORE_1_1_0",
"POST_1_0_MERGE",
"PRE_1_0_MERGE",
"GGV_0_61",
"merge-from-trunk-19990823",
"bp_panel-1-1-test",
"GNOME_CORE_1_0_ANCHOR",
"GNOME_CORE_1_0_5",
"GNOME_CORE_1_0_4",
"GNOME_CORE_1_0_3",
"GNOME_CORE_1_0_1",
"GNOME_CORE_1_0_0_1",
"GNOME_0_99_8_1",
"GNOME_0_99_8",
"GNOME_0_99_7",
"GNOME_0_99_3",
"GNOME_0_99_2",
"GNOME_STABLE_ANCHOR",
"PRE_PANEL2",
"GNOME_0_30_PATCHES",
"PANTING_CHIMPANZEE",
"GNOME_0_30",
"GNOME_0_28_MARTIN",
"GNOME_0_27",
"GNOME_0_25",
"DROOLING_MACAQUE",
"OWEN_SMPROXY",
"GNOME_0_20a",
"GNOME_0_20",
"ROSALIA_BEFORE_COMMITTING_DL_AND_GNOME_HELLO",
"GNOME_0_12",
"V_0_11",
"SNAP_19971121"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-11171.json",
"vanir_signatures": [
{
"id": "CVE-2017-11171-094688f1",
"digest": {
"length": 313,
"function_hash": "196516828425854704600069833774869127186"
},
"source": "https://github.com/gnome/gnome-session/commit/b0dc999e0b45355314616321dbb6cb71e729fc9d",
"target": {
"file": "gnome-session/gsm-xsmp-client.c",
"function": "_client_protocol_timeout"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-11171-0c51ba99",
"digest": {
"threshold": 0.9,
"line_hashes": [
"246052278573976905993052853135838941900",
"216647078693800071709536745575778831495",
"125323150175774701570763565704481192565",
"272648036610675759735126428858200186292",
"7199900871993228273929226317182801525",
"52244597089887208701768009408071698858",
"85818782022103225489704410279927911354",
"230972050434433537214918271328887738472",
"212881580650140877126829664296030337388",
"299800521118025171502328433359995331585",
"27077449239917566857221385230522791576",
"183682617022268511733557701096345486089",
"135065171883166116432362015177700911615",
"224765835644235508839002097000208667859",
"8339843695161604761840868336158755625",
"89472297819279049436313013198908180690",
"75308604784820499114341534840883307329",
"264151996534980048357108366636928652024",
"332623564837455526954761976411220291091",
"327954259321688031300489987730323425152",
"211018499808660414595635994547364618313",
"211880672526964726539568834908218269246",
"9637136472113501042834424912329040681",
"295903890061907289061289063725386580394",
"165400235409505735919088684549478546481",
"263196535468032941744366878025861593316",
"74257714660273787449220531844018483487",
"156935924700118813649972528964293913141",
"301546150717769694620434142133319669549",
"57428275378058971095913522759901558853",
"212562150894167345899335704470970043386",
"256567119145155710014301156217794441256",
"269827114286147280380867059246656545283",
"141850781719880053140909988083024156112",
"30095422911489077731553098645660852775",
"304048611345355723494337788773215077054"
]
},
"source": "https://github.com/gnome/gnome-session/commit/b0dc999e0b45355314616321dbb6cb71e729fc9d",
"target": {
"file": "gnome-session/gsm-xsmp-server.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-11171-7624cf71",
"digest": {
"length": 1978,
"function_hash": "302317858585378050085591924582156896942"
},
"source": "https://github.com/gnome/gnome-session/commit/b0dc999e0b45355314616321dbb6cb71e729fc9d",
"target": {
"file": "gnome-session/gsm-xsmp-client.c",
"function": "gsm_xsmp_client_connect"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-11171-8e6d492e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164155508443156060304660115733379353465",
"46562645610390457966472196967927045851",
"237342975235701095686332348773801704354",
"133087739453313786153791781010245281623",
"73184234532666125044957382848032225420",
"174881206082921373697632575276489932386",
"304611542578597753427393407466559067527",
"301265976706046814283920294569055586675",
"338624178062875522381470896521430771216",
"105720447373571480362085806578673557193",
"331851902089008826521795398507568492305",
"178395035042022178600182398204051566617",
"296942518513271823871942324070953836909",
"49158315172815176435770622926942182343",
"103871556222061905348288388073546077899",
"104490782869903383601651043675990396568",
"315885872583185139327110227606084325210",
"159178821082147474607753870640761735337",
"216840881908658432527363567183409828119",
"132079026218626214004472901776221219405",
"85694775748452861855016398568011920527",
"334446916947422948205770671346649677247",
"183404435767535704498759472213751966699",
"338457941626081683414157259530028153492",
"13496024676199772868601476962864016851",
"140095063926738880239194977870480754084",
"150897119120354154261228843133628515145",
"188411745139188377735092676114819328990",
"924587825911717173386393544955072693",
"169920702496948769733862218930122859408",
"218145862260884007122102276710543524675",
"145943303892553474499677898590865096028",
"335070514527316704830969885792182335334",
"250392036159702582678132126853695445483",
"49428595766736728804586579102091651945",
"301246866214731398401683168926168350711"
]
},
"source": "https://github.com/gnome/gnome-session/commit/b0dc999e0b45355314616321dbb6cb71e729fc9d",
"target": {
"file": "gnome-session/gsm-xsmp-client.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-11171-ae1ee605",
"digest": {
"length": 549,
"function_hash": "965721689899034524941069827456668968"
},
"source": "https://github.com/gnome/gnome-session/commit/b0dc999e0b45355314616321dbb6cb71e729fc9d",
"target": {
"file": "gnome-session/gsm-xsmp-server.c",
"function": "accept_ice_connection"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-11171-ca42a0de",
"digest": {
"length": 454,
"function_hash": "211663146165553600761632647029834317642"
},
"source": "https://github.com/gnome/gnome-session/commit/b0dc999e0b45355314616321dbb6cb71e729fc9d",
"target": {
"file": "gnome-session/gsm-xsmp-client.c",
"function": "gsm_xsmp_client_disconnect"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-11171-cc931597",
"digest": {
"length": 608,
"function_hash": "293494865280888655094723583307756506660"
},
"source": "https://github.com/gnome/gnome-session/commit/b0dc999e0b45355314616321dbb6cb71e729fc9d",
"target": {
"file": "gnome-session/gsm-xsmp-client.c",
"function": "setup_connection"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-11171-df01c64d",
"digest": {
"length": 535,
"function_hash": "223928067718034735288075763649363180867"
},
"source": "https://github.com/gnome/gnome-session/commit/b0dc999e0b45355314616321dbb6cb71e729fc9d",
"target": {
"file": "gnome-session/gsm-xsmp-server.c",
"function": "accept_xsmp_connection"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:16:30Z"
}
}
],
"modified": "2026-10-20T13:16:30.695945476Z",
"provider": "osv",
"references": [
"https://github.com/GNOME/gnome-session/commit/b0dc999e0b45355314616321dbb6cb71e729fc9d",
"https://bugzilla.suse.com/show_bug.cgi?id=1025068"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2017-11171",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387433,
"published_at": "2017-07-11T20:29:00.267+00:00"
}