PT-2017-4169 · Linux+3 · Linux Kernel+3

Gareth Evans · Published 2017-02-23 · Updated 2020-10-09 · CVE-2017-5669

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.9.12

Description The issue is related to the do shmat function in ipc/shm.c in the Linux kernel, which does not properly restrict the address calculated by a certain rounding operation. This allows local users to map page zero and bypass a protection mechanism that exists for the mmap system call. The exploitation can be done by making crafted shmget and shmat system calls in a privileged context. The vulnerability is also related to insufficient input validation.

Recommendations For Linux kernel versions prior to 4.9.12, update to a version 4.9.12 or later to resolve the issue. As a temporary workaround, consider restricting the use of the do shmat function in ipc/shm.c until a patch is available. Avoid making crafted shmget and shmat system calls in a privileged context to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2017-1854

ALT-PU-2018-1991

BDU:2021-06409

CVE-2017-5669

DLA-849-1

DSA-3804-1

OPENSUSE-SU-2017_0906-1

SUSE-SU-2017:1247-1

SUSE-SU-2017:1301-1

SUSE-SU-2017:1360-1

SUSE-SU-2017:2342-1

SUSE-SU-2017:2525-1

USN-3265-1

USN-3265-2

USN-3361-1

USN-3583-1

USN-3583-2

Affected Products

Alt Linux

Linux Kernel

Suse

Ubuntu

References · 454

• https://github.com/torvalds/linux/commit/e1d35d4dc7f089e6c9c080d556feedf9c706f0c7 · Patch
• https://github.com/torvalds/linux/commit/95e91b831f87ac8e1f8ed50c14d709089b4e01b8 · Patch
• https://ubuntu.com/security/CVE-2017-14156 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15274 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7889 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3361-1 · Vendor Advisory
• https://bugzilla.kernel.org/show_bug.cgi?id=192931 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3804-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5669 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9604 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5546 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3583-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3265-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-12192 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3583-1 · Vendor Advisory