PT-2017-15452 · Linux+4 · Linux Kernel+4

Adam Mariš · Published 2017-02-09 · Updated 2023-02-12 · CVE-2017-2618

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.9.10

Description A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files. An empty (null) write to this file can crash the system by causing the system to attempt to access unmapped kernel memory.

Recommendations For versions prior to 4.9.10, update to version 4.9.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the /proc/pid/attr files to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-193

CWE-682

Related Identifiers

ALT-PU-2017-1169

ALT-PU-2017-1330

CESA-2017_0933

CVE-2017-2618

DSA-3791-1

RHSA-2017:0931

RHSA-2017:0932

RHSA-2017:0933

RHSA-2017_0931

RHSA-2017_0933

USN-3361-1

USN-3381-1

USN-3381-2

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Ubuntu

References · 62

• https://ubuntu.com/security/CVE-2016-10208 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-2671 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-2618 · Security Note
• https://ubuntu.com/security/notices/USN-3381-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8636 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5550 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-1000365 · Vendor Advisory
• https://debian.org/security/2017/dsa-3791 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7889 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-1350 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-2584 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6001 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-2583 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6214 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5669 · Vendor Advisory