Out-of-bounds read in Linux kernel - CVE-2017-17741

 

Out-of-bounds read in Linux kernel - CVE-2017-17741

Published: December 26, 2017


Vulnerability identifier: #VU9773
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-17741
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists due to an error in the KVM implementation in the Linux kernel. A local attacker can trigger write_mmio stack-based out-of-bounds read or possibly have unspecified other impact, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h and cause the system to crash.

Successful exploitation of the vulnerability results in denial of service.

Affected software

Linux kernel
Debian Linux
Amazon Linux AMI
SUSE Linux
Fedora
Opensuse
kernel

How to mitigate CVE-2017-17741

Update to version 4.14.7.

kernel - addressed in versions 4.14.8-200.fc26, 4.14.8-300.fc27

External References

Related Security Bulletins