PT-2017-15055 · Linux+3 · Linux Kernel+3

Jann Horn · Publicado 2017-12-23 · Atualizado 2021-12-06 · CVE-2017-17864

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.14.9

Description The issue allows local users to obtain potentially sensitive address information due to a "pointer leak" caused by mishandling states equal comparisons between the pointer data type and the UNKNOWN VALUE data type in kernel/bpf/verifier.c.

Recommendations For Linux kernel versions prior to 4.14.9, update to version 4.14.9 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2018-1016

ALT-PU-2018-1991

CVE-2017-17864

DSA-4073-1

MGASA-2018-0062

MGASA-2018-0063

MGASA-2018-0064

OPENSUSE-SU-2018_0408-1

SUSE-SU-2018:0383-1

SUSE-SU-2018:0416-1

SUSE-SU-2018:0482-1

SUSE-SU-2018:0986-1

SUSE-SU-2021:3935-1

USN-3523-1

USN-3523-2

USN-3523-3

Produtos afetados

Alt Linux

Linux Kernel

Suse

Ubuntu

Referências · 370

• https://osv.dev/vulnerability/SUSE-SU-2018:0383-1 · Aviso do Fabricante
• https://bugzilla.suse.com/1083223 · Nota
• https://bugzilla.suse.com/1189706 · Nota
• https://suse.com/support/update/announcement/2018/suse-su-20180416-1 · Nota
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.4 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-17864 · Aviso do Fabricante
• https://bugzilla.suse.com/1082795 · Nota
• https://suse.com/security/cve/CVE-2018-5332 · Nota
• https://bugzilla.suse.com/1076806 · Nota
• https://bugzilla.suse.com/1072163 · Nota
• https://bugzilla.suse.com/1062129 · Nota
• https://bugzilla.suse.com/1185758 · Nota
• https://bugzilla.suse.com/1192781 · Nota
• https://osv.dev/vulnerability/MGASA-2018-0064 · Aviso do Fabricante
• http://securityfocus.com/bid/102320 · Nota