PT-2017-10944 · Linux+2 · Linux+2

Published 2017-10-09 · Updated 2018-04-11 · CVE-2017-1000255

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux versions 4.9-rc1 and later, with CONFIG PPC TRANSACTIONAL MEM enabled

Description A flaw in the Linux kernel allows a user process to craft a signal frame and trigger an exception, enabling an attacker to overwrite arbitrary kernel memory locations with arbitrary values. This occurs on Linux running on PowerPC hardware (Power8 or later) when a sigreturn is executed after crafting a signal frame. The exception handling produces an oops and potentially a panic if panic on oops=1, but only after kernel memory has been overwritten.

Recommendations For Linux versions 4.9-rc1 and later with CONFIG PPC TRANSACTIONAL MEM enabled, consider disabling transactional memory (TM) support by setting CONFIG PPC TRANSACTIONAL MEM to 'n' to mitigate the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2017-2424

ALT-PU-2017-2425

CVE-2017-1000255

RHSA-2018:0654

USN-3443-1

USN-3443-2

USN-3487-1

Affected Products

Alt Linux

Linux

Ubuntu

References · 60

• https://ubuntu.com/security/notices/USN-3443-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02568 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-1000255 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-2424 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14954 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-12188 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-2425 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3443-2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000255 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02564 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000255 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9568 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15649 · Security Note
• https://ubuntu.com/security/CVE-2017-16534 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14489 · Vendor Advisory