VulnerabilityModified
CVE-2017-16994
The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call.
MEDIUM 5.5EPSS 2.08%
Does this matter?
Lower severity and a low EPSS score (2.08%). Track it; it rarely justifies an emergency change on its own.
Description
The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call.
- CVSS 3.0
- 5.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 2.08% probability · 80th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- linux/linux kernel
- Source
- cve@mitre.org
References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=373c4557d2aa362702c4c2d41288fb1e54990b7cPatch
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.2Release Notes
- http://www.securityfocus.com/bid/101969Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:0502
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1431Exploit, Issue Tracking, Patch
- https://github.com/torvalds/linux/commit/373c4557d2aa362702c4c2d41288fb1e54990b7cPatch
- https://usn.ubuntu.com/3617-1/
- https://usn.ubuntu.com/3617-2/
- https://usn.ubuntu.com/3617-3/
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3632-1/
- https://www.exploit-db.com/exploits/43178/Exploit, Third Party Advisory, VDB Entry
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=373c4557d2aa362702c4c2d41288fb1e54990b7cPatch
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.2Release Notes
- http://www.securityfocus.com/bid/101969Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:0502
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1431Exploit, Issue Tracking, Patch
- https://github.com/torvalds/linux/commit/373c4557d2aa362702c4c2d41288fb1e54990b7cPatch
- https://usn.ubuntu.com/3617-1/
- https://usn.ubuntu.com/3617-2/
- https://usn.ubuntu.com/3617-3/
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3632-1/
- https://www.exploit-db.com/exploits/43178/Exploit, Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.