Memory leak in Linux kernel - CVE-2017-14991

Vulnerability identifier: #VU8693

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-14991

CWE-ID: CWE-401

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak in sg_ioctl() function in drivers/scsi/sg.c. A local user can obtain sensitive information from uninitialized kernel heap-memory locations via an SG_GET_REQUEST_TABLE ioctl call for /dev/sg0.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-kvm (Ubuntu package)
linux-aws (Ubuntu package)
linux-gke (Ubuntu package)
linux-snapdragon (Ubuntu package)

Update to version 4.13.4.

linux (Ubuntu package) - update to 4.4.0-98.121
linux-kvm (Ubuntu package) - update to 4.4.0-1009.14
linux-aws (Ubuntu package) - update to 4.4.0-1039.48
linux-gke (Ubuntu package) - update to 4.4.0-1033.33
linux-snapdragon (Ubuntu package) - update to 4.4.0-1078.83

• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3e0097499839e0fe3af380410e...
• http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.4 
• https://github.com/torvalds/linux/commit/3e0097499839e0fe3af380410eababe5a47c4cf9

• Privilege escalation in Linux kernel
• Ubuntu update for linux, linux-aws, linux-gke and more