Information disclosure in Linux kernel - CVE-2017-7616

 

Information disclosure in Linux kernel - CVE-2017-7616

Published: May 22, 2017


Vulnerability identifier: #VU6613
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-7616
CWE-ID: CWE-388
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to obtain potentially sensitive information from system memory

The weakness exists due to an error handling flaw in the set_mempolicy() and mbind compat() system calls in 'mm/mempolicy.c'. A local attacker can trigger a failure of a certain bitmap operation and obtain sensitive information from uninitialized stack data.

Successful exploitation of the vulnerability results in information disclosure.

Affected software

Linux kernel
SUSE Linux
Fedora
kernel

How to mitigate CVE-2017-7616

Install update from vendor's website.

kernel - addressed in versions 4.10.10-100.fc24, 4.10.10-200.fc25

External References

Related Security Bulletins