Vulnerability Details : CVE-2017-15299
Potential exploit
The KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of add_key for a key that already exists but is uninstantiated, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted system call.
Vulnerability category: Memory CorruptionDenial of service
Products affected by CVE-2017-15299
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-15299
0.01%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 1 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-15299
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.9
|
MEDIUM | AV:L/AC:L/Au:N/C:N/I:N/A:C |
3.9
|
6.9
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2017-15299
-
The product dereferences a pointer that it expects to be valid but is NULL.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-15299
-
https://bugzilla.redhat.com/show_bug.cgi?id=1498016
1498016 – (CVE-2017-15299) CVE-2017-15299 kernel: Incorrect updates of uninstantiated keys crash the kernelIssue Tracking;Third Party Advisory
-
https://marc.info/?t=150654188100001&r=1&w=2
'[PATCH v3 1/7] KEYS: don't let add_key() update an uninstantiated key' thread - MARCIssue Tracking;Patch;Third Party Advisory
-
https://usn.ubuntu.com/3798-2/
USN-3798-2: Linux kernel (Trusty HWE) vulnerabilities | Ubuntu security notices
-
https://marc.info/?t=150783958600011&r=1&w=2
'[PATCH 12/15] KEYS: don't let add_key() update an uninstantiated key' thread - MARCIssue Tracking;Patch;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html
[SECURITY] [DLA 1200-1] linux security update
-
https://usn.ubuntu.com/3798-1/
USN-3798-1: Linux kernel vulnerabilities | Ubuntu security notices
-
https://access.redhat.com/errata/RHSA-2018:0654
RHSA-2018:0654 - Security Advisory - Red Hat Customer Portal
-
https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1499828.html
[PATCH v3 1/7] KEYS: don't let add_key() update an uninstantiated keyExploit;Issue Tracking;Mailing List;Patch;Third Party Advisory
Jump to