CVE-2017-15274
kernel: dereferencing NULL payload with nonzero length
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
security/keys/keyctl.c in the Linux kernel before 4.11.5 does not consider the case of a NULL payload in conjunction with a nonzero length value, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted add_key or keyctl system call, a different vulnerability than CVE-2017-12192.
security/keys/keyctl.c en el kernel de Linux en versiones anteriores a la 4.11.5 no tiene en cuenta el caso de una carga útil NULL junto con un valor de longitud que no sea cero, lo que permite a usuarios locales provocar una denegación de servicio (desreferencia de puntero NULL and OOPS) mediante una llamada de sistema add_key o keyctl manipulada. Esta es una vulnerabilidad diferente a CVE-2017-12192.
A flaw was found in the implementation of associative arrays where the add_key systemcall and KEYCTL_UPDATE operations allowed for a NULL payload with a nonzero length. When accessing the payload within this length parameters value, an unprivileged user could trivially cause a NULL pointer dereference (kernel oops).
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-10-11 CVE Reserved
- 2017-10-12 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-476: NULL Pointer Dereference
CAPEC
References (11)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/101292 | Third Party Advisory | |
| https://bugzilla.suse.com/show_bug.cgi?id=1045327 | Issue Tracking |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.5 | 2018-03-16 | |
| https://access.redhat.com/errata/RHSA-2019:1946 | 2018-03-16 | |
| https://usn.ubuntu.com/3583-1 | 2018-03-16 | |
| https://usn.ubuntu.com/3583-2 | 2018-03-16 | |
| https://access.redhat.com/security/cve/CVE-2017-15274 | 2019-07-30 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1500391 | 2019-07-30 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | <= 4.11.4 Search vendor "Linux" for product "Linux Kernel" and version " <= 4.11.4" | - |
Affected
| ||||||