Memory leak in Linux kernel - CVE-2017-17864

Vulnerability identifier: #VU9780

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-17864

CWE-ID: CWE-401

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.

The weakness exists due to kernel/bpf/verifier.c in the Linux kernel mishandles states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type. A local attacker can trigger a memory leak and obtain potentially sensitive address information.

Linux kernel
Debian Linux
Arch Linux
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Availability
SUSE Linux Enterprise Server
Ubuntu
Fedora
kgraft-patch-4_4_180-94_150-default
kgraft-patch-4_4_180-94_150-default-debuginfo
kernel-devel
ocfs2-kmp-default-debuginfo
ocfs2-kmp-default
gfs2-kmp-default-debuginfo
gfs2-kmp-default
dlm-kmp-default-debuginfo
dlm-kmp-default
cluster-md-kmp-default-debuginfo
cluster-md-kmp-default
kernel-default-man
kernel-source
kernel-macros
kernel-syms
kernel-default-kgraft
kernel-default-devel
kernel-default-debugsource
kernel-default-debuginfo
kernel-default-base-debuginfo
kernel-default-base
kernel-default
kernel

Update to version 4.14.8.

kgraft-patch-4_4_180-94_150-default - update to 1-4.3.1
kgraft-patch-4_4_180-94_150-default-debuginfo - update to 1-4.3.1
kernel-devel - update to 4.4.180-94.150.1
ocfs2-kmp-default-debuginfo - update to 4.4.180-94.150.1
ocfs2-kmp-default - update to 4.4.180-94.150.1
gfs2-kmp-default-debuginfo - update to 4.4.180-94.150.1
gfs2-kmp-default - update to 4.4.180-94.150.1
dlm-kmp-default-debuginfo - update to 4.4.180-94.150.1
dlm-kmp-default - update to 4.4.180-94.150.1
cluster-md-kmp-default-debuginfo - update to 4.4.180-94.150.1
cluster-md-kmp-default - update to 4.4.180-94.150.1
kernel-default-man - update to 4.4.180-94.150.1
kernel-source - update to 4.4.180-94.150.1
kernel-macros - update to 4.4.180-94.150.1
kernel-syms - update to 4.4.180-94.150.1
kernel-default-kgraft - update to 4.4.180-94.150.1
kernel-default-devel - update to 4.4.180-94.150.1
kernel-default-debugsource - update to 4.4.180-94.150.1
kernel-default-debuginfo - update to 4.4.180-94.150.1
kernel-default-base-debuginfo - update to 4.4.180-94.150.1
kernel-default-base - update to 4.4.180-94.150.1
kernel-default - update to 4.4.180-94.150.1
kernel - addressed in versions 4.14.11-200.fc26, 4.14.11-300.fc27

• https://github.com/torvalds/linux/commit/179d1c5602997fef5a940c6ddcf31212cbfebd14#diff-3f169a344ebaf...

• Debian update for linux
• Multiple vulnerabilities in Linux Kernel
• SUSE Linux update for the Linux Kernel
• SUSE Linux update for the Linux Kernel
• OpenSUSE Linux update for the Linux Kernel
• SUSE Linux update for the Linux Kernel
• Ubuntu update for Linux kernel (HWE)
• Ubuntu update for Linux kernel (Raspberry Pi 2)
• Ubuntu update for Linux kernel
• Arch Linux update for linux-lts
• SUSE Linux update for the Linux Kernel
• Arch Linux update for linux-zen
• Fedora 27 update for kernel
• Fedora 26 update for kernel
• SUSE update for the Linux Kernel