PT-2017-14686 · Linux+1 · Linux Kernel+1

Published 2017-08-30 · Updated 2023-06-21 · CVE-2017-17053

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.12.10

Description The issue arises from the init new context function in the Linux kernel, which does not correctly handle errors from LDT table allocation when forking a new process. This allows a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program. The vulnerability is specific to kernels built with CONFIG MODIFY LDT SYSCALL=y.

Recommendations For versions prior to 4.12.10, update to version 4.12.10 or later to resolve the issue. As a temporary workaround, consider disabling the init new context function or restricting the use of CONFIG MODIFY LDT SYSCALL=y until a patch is available.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2017-2130

ALT-PU-2017-2131

CVE-2017-17053

SUSE-SU-2018:2413-1

Affected Products

Alt Linux

Linux Kernel

References · 25

• https://github.com/torvalds/linux/commit/ccd5b3235180eef3cfec337df1c8554ab151b5cc · Patch
• https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.10 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-17053 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-17053 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-17053 · Security Note
• https://ubuntu.com/security/CVE-2017-17053 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2413-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0676 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-17053 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-17053 · Vendor Advisory
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ccd5b3235180eef3cfec337df1c8554ab151b5cc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17053 · Security Note
• https://suse.com/security/cve/CVE-2017-17053 · Note
• https://suse.com/security/cve/CVE-2018-10853 · Note
• https://bugzilla.suse.com/1097108 · Note