PT-2017-2424 · Linux+2 · Linux Kernel+2
Pengfei Wang
·
Publicado
2017-06-28
·
Atualizado
2023-02-24
·
CVE-2017-9985
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 4.11.7
Description
The issue is related to the
snd msndmidi input read function in the Linux kernel, specifically in the sound/isa/msnd/msnd midi.c file. It is caused by an out-of-bounds access in memory, which can be exploited to cause a denial of service or potentially have other unspecified impacts. This can be achieved by locally changing the value of a message queue head pointer between two kernel reads of that value, also known as a "double fetch" vulnerability.Recommendations
For Linux kernel versions prior to 4.11.7, update to version 4.11.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the
snd msndmidi input read function to minimize the risk of exploitation.Correção
DoS
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Linux Kernel
Ubuntu