Описание
The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
It was found that the blk_rq_map_user_iov() function in the Linux kernel's block device implementation did not properly restrict the type of iterator, which could allow a local attacker to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging write access to a /dev/sg device.
Отчет
This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 as the code which can trigger the flaw is not present in the products listed. This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | kernel | Not affected | ||
| Red Hat Enterprise Linux 6 | kernel | Fixed | RHSA-2017:0817 | 21.03.2017 |
| Red Hat Enterprise Linux 7 | kernel-rt | Fixed | RHSA-2017:2077 | 01.08.2017 |
| Red Hat Enterprise Linux 7 | kernel | Fixed | RHSA-2017:1842 | 01.08.2017 |
| Red Hat Enterprise MRG 2 | kernel-rt | Fixed | RHSA-2017:2669 | 06.09.2017 |
Показывать по
Дополнительная информация
Статус:
7 High
CVSS3
6.2 Medium
CVSS2
Связанные уязвимости
The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
The blk_rq_map_user_iov function in block/blk-map.c in the Linux kerne ...
Security update for the openSUSE Leap 42.1 kernel.
7 High
CVSS3
6.2 Medium
CVSS2