SB2019081911 - Information disclosure in Linux kernel

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019081911

SB2019081911 - Information disclosure in Linux kernel

Published: August 19, 2019 Updated: September 4, 2019

Security Bulletin ID SB2019081911
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Information disclosure (CVE-ID: CVE-2017-18549)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists in the "drivers/scsi/aacraid/commctrl.c" file due to insufficient initialization of the reply structure by the "aac_send_raw_srb" function. A local authenticated user can access the system, execute an application that submits malicious input to the affected software and access sensitive stack memory information.





Remediation

Install update from vendor's website.

References