Null pointer dereference in Linux kernel - CVE-2017-15299

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU9602

Null pointer dereference in Linux kernel - CVE-2017-15299

Published: December 8, 2017


Vulnerability identifier: #VU9602
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-15299
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists due to the KEYS subsystem mishandles use of add_key for a key that already exists but is uninstantiated. A local attacker can supply specially crafted keys, trigger null pointer dereference and cause the service to crash.

Successful exploitation of the vulnerability results in denial of service.

Affected software

Linux kernel
Amazon Linux AMI
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for IBM System z (Structure A)
SUSE Linux
Ubuntu
Fedora

kernel-alt (Red Hat package)
kernel

How to mitigate CVE-2017-15299

Update to version 4.13.7.

kernel-alt (Red Hat package) - update to 4.14.0-49.el7a
kernel - addressed in versions 4.13.6-100.fc25, 4.13.6-200.fc26, 4.13.6-300.fc27, 4.13.8-100.fc25, 4.13.8-200.fc26, 4.13.8-300.fc27

External References

Related Security Bulletins