PT-2017-1184 · Linux+2 · Linux Kernel+2

Adam Mariš · Published 2017-01-10 · Updated 2023-02-28 · CVE-2017-5546

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions 4.8.x through 4.9.x before 4.9.5 Linux kernel version 4.9.x before 4.9.5

Description The freelist-randomization feature in the Linux kernel allows local users to cause a denial of service, resulting in duplicate freelist entries and system crash, or possibly have unspecified other impact in opportunistic circumstances by leveraging the selection of a large value for a random number. This issue is related to errors in number processing.

Recommendations For Linux kernel versions 4.8.x through 4.9.x before 4.9.5, update to version 4.9.5 or later to resolve the issue. For Linux kernel version 4.9.x before 4.9.5, update to version 4.9.5 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

ALT-PU-2017-1063

BDU:2017-00295

CVE-2017-5546

USN-3361-1

Affected Products

Alt Linux

Linux Kernel

Ubuntu

References · 61

• https://github.com/torvalds/linux/commit/c4e490cf148e85ead0d1b1c2caaba833f1d5b29f · Patch
• https://ubuntu.com/security/CVE-2017-2618 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-2671 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5551 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-2583 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7273 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9604 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5546 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7261 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5546 · Security Note
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c4e490cf148e85ead0d1b1c2caaba833f1d5b29f · Patch
• https://ubuntu.com/security/CVE-2016-8405 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10208 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-8924 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00295 · Security Note