Information disclosure in Linux kernel - CVE-2017-16994

Vulnerability identifier: #VU9765

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-16994

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.

The weakness exists due to the walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel mishandles holes in hugetlb ranges. A local attacker can make specially crafted mincore() system call and obtain sensitive information from uninitialized kernel memory.

Linux kernel
Amazon Linux AMI
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power 9
SUSE Linux
Fedora
kernel-alt (Red Hat package)
kernel

Update to version 4.14.2.

kernel-alt (Red Hat package) - update to 4.11.0-44.6.1.el7a
kernel - addressed in versions 4.13.16-100.fc25, 4.13.16-200.fc26, 4.13.16-300.fc27

• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=373c4557d2aa362702c4c2...

• Amazon Linux AMI update for kernel
• SUSE Linux update for the Linux Kernel
• SUSE Linux update for the Linux Kernel
• OpenSUSE Linux update for the Linux Kernel
• OpenSUSE Linux update for the Linux Kernel
• SUSE Linux update for the Linux Kernel
• Red Hat Enterprise Linux 7 update for kernel-alt
• Fedora 27 update for kernel
• Fedora 26 update for kernel
• Fedora 25 update for kernel