PT-2017-15055 · Linux+3 · Linux Kernel+3

Jann Horn · Published 2017-12-23 · Updated 2021-12-06 · CVE-2017-17864

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.14.9

Description The issue allows local users to obtain potentially sensitive address information due to a "pointer leak" caused by mishandling states equal comparisons between the pointer data type and the UNKNOWN VALUE data type in kernel/bpf/verifier.c.

Recommendations For Linux kernel versions prior to 4.14.9, update to version 4.14.9 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2018-1016

ALT-PU-2018-1991

CVE-2017-17864

DSA-4073-1

MGASA-2018-0062

MGASA-2018-0063

MGASA-2018-0064

OPENSUSE-SU-2018_0408-1

SUSE-SU-2018:0383-1

SUSE-SU-2018:0416-1

SUSE-SU-2018:0482-1

SUSE-SU-2018:0986-1

SUSE-SU-2021:3935-1

USN-3523-1

USN-3523-2

USN-3523-3

Affected Products

Alt Linux

Linux Kernel

Suse

Ubuntu

References · 370

• https://osv.dev/vulnerability/SUSE-SU-2018:0383-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-17864 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0064 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17864 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:3935-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-17864 · Security Note
• https://ubuntu.com/security/CVE-2017-17863 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0062 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0063 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0062.html · Security Note
• https://osv.dev/vulnerability/DSA-4073-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16995 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-17864 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-17864 · Vendor Advisory
• https://usn.ubuntu.com/usn/usn-3523-2 · Vendor Advisory