NetSight
IP …
medium5.5

CVE-2017-18344

The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify fi…

Impact

The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).

Affected products

VendorProductAffected versions
LinuxLinux Kernel
before 4.14.8
CanonicalUbuntu Linux
Versions 12.04, 14.04
RedhatMrg Realtime
Version 2.0
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Aus
Versions 7.2, 7.3, 7.4
RedhatEnterprise Linux Server Eus
Versions 7.3, 7.5
RedhatEnterprise Linux Server Tus
Versions 7.2, 7.3, 7.4
RedhatEnterprise Linux Workstation
Version 7.0

Weakness classification

CWE-125

References