vulnwire
5.5med

CVE-2017-169943 exploits

The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local u…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
5.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.1%
percentile 82%
Public exploits
3
Exploit-DB

The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call.

Exploit prediction (EPSS)

2.08% probability of exploitation in the next 30 days, higher than 82% of all scored CVEs.

Exploits and detections

  • EDB-44304 Linux Kernel - 'mincore()' Heap Page Disclosure (PoC) · dos · 2017-12-11
  • EDB-44303 Linux Kernel 4.13 (Debian 9) - Local Privilege Escalation · local · 2017-12-11
  • EDB-43178 Linux Kernel - 'mincore()' Uninitialized Kernel Heap Page Disclosure · dos · 2017-11-24

CVSS scores

Assigned byVersionScoreVector
NVD3.05.5CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD2.02.1AV:L/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Technology feeds
Linux kernel (RSS, critical only)

References

  • usn.ubuntu.com /3617-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • usn.ubuntu.com /3619-2/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • bugs.chromium.org /p/project-zero/issues/detail?id=1431 · x_refsource_CONFIRM, x_transferred
  • usn.ubuntu.com /3617-3/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • exploit-db.com /exploits/43178/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • kernel.org /pub/linux/kernel/v4.x/ChangeLog-4.14.2 · x_refsource_CONFIRM, x_transferred
  • usn.ubuntu.com /3632-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • git.kernel.org /cgit/linux/kernel/git/torvalds/linux.git/commit/?id=373c4557d2aa362702c4c2d41288fb1e54990 · x_refsource_CONFIRM, x_transferred
  • access.redhat.com /errata/RHSA-2018:0502 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • usn.ubuntu.com /3617-2/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • github.com /torvalds/linux/commit/373c4557d2aa362702c4c2d41288fb1e54990b7c · x_refsource_CONFIRM, x_transferred
  • usn.ubuntu.com /3619-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • securityfocus.com /bid/101969 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.