Integer overflow in Linux kernel - CVE-2017-14051

Vulnerability identifier: #VU10715

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-14051

CWE-ID: CWE-190

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.ct due to an integer overflow. A local attacker can gain root access and cause the service to crash.

Linux kernel
SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME
SUSE Linux Enterprise Server 11
SUSE Linux
Ubuntu
Fedora
kernel-ec2
kernel-default
kernel-trace
kernel-xen
kernel-trace-devel
kernel-default-base
kernel-ec2-base
kernel-xen-devel
kernel-ec2-devel
kernel-default-devel
kernel-trace-base
kernel-source
kernel-syms
kernel-xen-base
kernel

Update to version 4.13 or later.

kernel-ec2 - update to 3.0.101-108.174.1
kernel-default - update to 3.0.101-108.174.1
kernel-trace - update to 3.0.101-108.174.1
kernel-xen - update to 3.0.101-108.174.1
kernel-trace-devel - update to 3.0.101-108.174.1
kernel-default-base - update to 3.0.101-108.174.1
kernel-ec2-base - update to 3.0.101-108.174.1
kernel-xen-devel - update to 3.0.101-108.174.1
kernel-ec2-devel - update to 3.0.101-108.174.1
kernel-default-devel - update to 3.0.101-108.174.1
kernel-trace-base - update to 3.0.101-108.174.1
kernel-source - update to 3.0.101-108.174.1
kernel-syms - update to 3.0.101-108.174.1
kernel-xen-base - update to 3.0.101-108.174.1
kernel - addressed in versions 4.12.11-200.fc25, 4.12.11-300.fc26

• https://patchwork.kernel.org/patch/9929625/

• Ubuntu update for Linux kernel
• Ubuntu update for Linux kernel (Trusty HWE)
• OpenSUSE Linux update for the Linux Kernel
• OpenSUSE Linux update for the Linux Kernel
• SUSE Linux update for the Linux Kernel
• SUSE update for the Linux Kernel
• Fedora 26 update for kernel
• Fedora 25 update for kernel