LiveActive security incident?Get immediate response
CVE Record

CVE-2017-11171: Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gn...

Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This flaw lets a local user make an affected GNOME graphical session stop working by exhausting file descriptors in gnome-session. The result is a frozen or broken desktop session and high CPU use, not remote compromise or data theft based on the provided sources.

Executive priority

Treat this as a legacy desktop availability issue. It is not presented as remotely exploitable, but vulnerable shared workstations or VDI hosts could suffer user disruption and support impact.

Technical view

Old gnome-session versions up to 2.29.92 mishandle reference counting in accept_ice_connection() in gsm-xsmp-server.c. Failed ICE authentication with invalid magic cookies leaks file descriptors. Once exhausted, gnome-session loops unsuccessfully and consumes 100% CPU, preventing normal session communication.

Likely exposure

Exposure is mainly legacy Linux desktop or VDI systems running affected old GNOME session packages. Server-only systems without gnome-session are unlikely to be exposed based on the provided description.

Exploitation context

CISA KEV is false, and the supplied sources do not state active exploitation. The described attacker must be local and able to trigger failed ICE authentication attempts against gnome-session.

Researcher notes

The evidence is clear on root cause and impact but incomplete on distribution-specific affected package ranges, CVSS, and broad exploit history. Validate through vendor packages and the GNOME commit rather than extrapolating affected products.

Mitigation direction

  • Update gnome-session through vendor packages that include the GNOME reference-counting fix.
  • Prioritize legacy Linux desktop and VDI images for package review.
  • Retire or isolate desktop builds still using affected old GNOME session versions.
  • Check vendor advisories for supported backports before assuming version numbers alone.
  • Monitor affected endpoints for abnormal gnome-session CPU use or session failures.

Validation and detection

  • Inventory systems running gnome-session, especially older desktop distributions.
  • Confirm installed packages are newer than affected versions or contain the referenced GNOME commit.
  • Review vendor changelogs for CVE-2017-11171 or the associated reference-counting fix.
  • Check endpoint telemetry for gnome-session file descriptor exhaustion or persistent high CPU.
  • Validate that desktop session communication remains stable after vendor updates.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2017-11171 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.