Resource management errors in Linux kernel - CVE-2017-18075

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU11764

Resource management errors in Linux kernel - CVE-2017-18075

Published: April 11, 2018


Vulnerability identifier: #VU11764
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-18075
CWE-ID: CWE-399
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in crypto/pcrypt.c due to mishandling freeing instances. A local attacker can gain access to the AF_ALG-based AEAD interface (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt (CONFIG_CRYPTO_PCRYPT), execute a crafted sequence of system calls and cause the service to crash (kfree of an incorrect pointer).

Affected software

Linux kernel
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for IBM System z (Structure A)
kernel-alt (Red Hat package)

How to mitigate CVE-2017-18075

Update to version 4.14.13.

kernel-alt (Red Hat package) - update to 4.14.0-115.el7a

External References

Related Security Bulletins