Integer overflow in Linux kernel - CVE-2017-18255
Published: April 4, 2018 / Updated: October 11, 2021
Vulnerability identifier: #VU11519
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-18255
CWE-ID: CWE-190
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to cause DoS condition on the target system.
The weakness exists due to improper validation of the input value from userspace when using the perf_cpu_time_max_percent_handler function, as defined in the kernel/events/core.c source code file. A local attacker can send specially crafted input that contains large values, trigger integer overflow and cause the service to crash.
The weakness exists due to improper validation of the input value from userspace when using the perf_cpu_time_max_percent_handler function, as defined in the kernel/events/core.c source code file. A local attacker can send specially crafted input that contains large values, trigger integer overflow and cause the service to crash.
Affected software
Linux kernel
MiR100
MiR200
MiR250
MiR500
MiR1000
MiR Fleet
MiR100
MiR200
MiR250
MiR500
MiR1000
MiR Fleet
How to mitigate CVE-2017-18255
Update to version 4.11 or later.
MiR100 - update to 2.10.2.1
MiR200 - update to 2.10.2.1
MiR250 - update to 2.10.2.1
MiR500 - update to 2.10.2.1
MiR1000 - update to 2.10.2.1
MiR Fleet - update to 2.10.2.1
MiR200 - update to 2.10.2.1
MiR250 - update to 2.10.2.1
MiR500 - update to 2.10.2.1
MiR1000 - update to 2.10.2.1
MiR Fleet - update to 2.10.2.1