NetSight
IP …
high7.8

CVE-2017-7889

The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or w…

Impact

The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file, related to arch/x86/mm/init.c and drivers/char/mem.c.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
before 3.2.91
from 3.3 before 3.10.107
from 3.11 before 3.12.74
from 3.13 before 3.16.46
from 3.17 before 3.18.50
from 3.19 before 4.1.41
DebianDebian Linux
Version 8.0
CanonicalUbuntu Linux
Versions 12.04, 14.04

Weakness classification

CWE-732

References