CVE-2017-11472

La función acpi_ns_terminate() en el archivo drivers/acpi/acpica/nsutils.c en el kernel de Linux anterior a versión 4.12, no limpia la caché operand y causa un volcado de pila del kernel, que permite a los usuarios locales obtener información confidencial de la memoria del kernel y omitir el mecanismo de protección KASLR (en el kernel hasta versión 4.9) por medio de una tabla ACPI creada.

Jann Horn discovered that the Berkeley Packet Filter implementation in the Linux kernel improperly performed sign extension in some situations. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. It was discovered that a race condition leading to a use-after-free vulnerability existed in the ALSA PCM subsystem of the Linux kernel. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Various other issues were also addressed.