CVE-2017-15265
kernel: Use-after-free in snd_seq_ioctl_create_port()
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c.
Condición de carrera en el subsistema ALSA en el kernel de Linux en versiones anteriores a la 4.13.8 permite que usuarios locales provoquen una denegación de servicio (uso de memoria previamente liberada) o posiblemente otro impacto mediante llamadas ioctl /dev/snd/seq ioctl manipuladas. Esto está relacionado con sound/core/seq/seq_clientmgr.c y sound/core/seq/seq_ports.c.
A use-after-free vulnerability was found when issuing an ioctl to a sound device. This could allow a user to exploit a race condition and create memory corruption or possibly privilege escalation.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-10-11 CVE Reserved
- 2017-10-16 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
- CWE-416: Use After Free
CAPEC
References (24)
URL | Tag | Source |
---|---|---|
http://www.securityfocus.com/bid/101288 | Third Party Advisory | |
http://www.securitytracker.com/id/1039561 | Third Party Advisory | |
https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 | Third Party Advisory | |
https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html | Mailing List | |
https://source.android.com/security/bulletin/2018-02-01 | Third Party Advisory | |
https://www.oracle.com/security-alerts/cpujul2020.html | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.8 | 2023-06-21 | |
https://access.redhat.com/errata/RHSA-2018:0676 | 2023-06-21 | |
https://access.redhat.com/errata/RHSA-2018:1062 | 2023-06-21 | |
https://access.redhat.com/errata/RHSA-2018:1130 | 2023-06-21 | |
https://access.redhat.com/errata/RHSA-2018:1170 | 2023-06-21 | |
https://access.redhat.com/errata/RHSA-2018:2390 | 2023-06-21 | |
https://access.redhat.com/errata/RHSA-2018:3822 | 2023-06-21 | |
https://access.redhat.com/errata/RHSA-2018:3823 | 2023-06-21 | |
https://usn.ubuntu.com/3698-1 | 2023-06-21 | |
https://usn.ubuntu.com/3698-2 | 2023-06-21 | |
https://access.redhat.com/security/cve/CVE-2017-15265 | 2018-12-13 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1501878 | 2018-12-13 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | < 3.2.95 Search vendor "Linux" for product "Linux Kernel" and version " < 3.2.95" | - |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.3 < 3.10.108 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.3 < 3.10.108" | - |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.11 < 3.16.50 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.11 < 3.16.50" | - |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.17 < 3.18.76 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.17 < 3.18.76" | - |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.19 < 4.1.46 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.19 < 4.1.46" | - |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.2 < 4.4.93 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.2 < 4.4.93" | - |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.5 < 4.9.57 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.5 < 4.9.57" | - |
Affected
| ||||||
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.10 < 4.13.8 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.10 < 4.13.8" | - |
Affected
|