Lucene search
Broadcom Security ResponseBSA-2017-304HistoryMay 17, 2017 - 12:00 a.m.
BSA-2017-304
2017-05-1700:00:00
Broadcom Security Response
53
EPSS
0
Percentile
10.1%
Summary
The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576.
Affected Products
| Product | Current Assessment |
|---|---|
| Brocade SLX-OS | Impacted: Fixed in 17r.1.01. |
Products Confirmed Not Vulnerable
Brocade FastIron OS, Brocade NetIron OS, Brocade ServerIron ADX, and Brocade Virtual Web Application Firewall are confirmed not affected by this vulnerability.
Workaround
There are no workarounds that address this vulnerability.
Revision History
| Version | Change | Date |
|---|---|---|
| 1.0 | Initial Publication | May 17, 2017 |
Related
cvelist
cvelist
CVE-2016-9576
2016-12-28 07:42:00
CVE-2016-10088
2016-12-30 18:00:00
f5
f5
K05513373 : Linux kernel vulnerability CVE-2016-9576
2017-01-27 00:00:00
K54610514 : Linux kernel vulnerability CVE-2016-10088
2017-01-27 00:00:00
suse
suse
Security update for the openSUSE Leap 42.1 kernel. (important)
2016-12-12 17:09:01
Security update for the Linux Kernel (important)
2016-12-12 17:06:57
Security update for the Linux Kernel (important)
2016-12-20 22:07:10
openvas
openvas
openSUSE: Security Advisory for kernel (openSUSE-SU-2016:3086-1)
2016-12-13 00:00:00
openSUSE: Security Advisory for kernel (openSUSE-SU-2016:3085-1)
2017-02-22 00:00:00
openSUSE: Security Advisory for kernel (openSUSE-SU-2016:3118-1)
2016-12-14 00:00:00
prion
prion
Design/Logic Flaw
2016-12-28 07:59:00
Code injection
2016-12-30 18:59:00
redhatcve
redhatcve
CVE-2016-9576
2016-12-09 08:47:27
CVE-2016-10088
2017-01-11 14:47:35
cve
cve
CVE-2016-9576
2016-12-28 07:59:00
CVE-2016-10088
2016-12-30 18:59:00
ubuntucve
ubuntucve
CVE-2016-9576
2016-12-28 00:00:00
CVE-2016-10088
2016-12-30 00:00:00
veracode
veracode
Denial Of Service (DoS)
2019-05-02 05:52:09
debiancve
debiancve
CVE-2016-9576
2016-12-28 07:59:00
CVE-2016-10088
2016-12-30 18:59:00
nvd
nvd
CVE-2016-9576
2016-12-28 07:59:00
CVE-2016-10088
2016-12-30 18:59:00
nessus
nessus
F5 Networks BIG-IP : Linux kernel vulnerability (K05513373)
2017-11-03 00:00:00
openSUSE Security Update : the Linux Kernel (openSUSE-2016-1438)
2016-12-13 00:00:00
amazon
amazon
Medium: kernel
2017-01-19 16:30:00
Medium: kernel
2017-01-04 17:00:00
mageia
mageia
Updated kernel and kmod packages fix security vulnerabilities
2016-12-29 13:29:11
Updated kernel-tmb packages fix security vulnerabilities
2017-01-04 01:05:03
Updated kernel-linus packages fix security vulnerabilities
2017-01-04 01:05:03
fedora
fedora
[SECURITY] Fedora 25 Update: kernel-4.8.13-300.fc25
2016-12-13 00:03:27
[SECURITY] Fedora 24 Update: kernel-4.8.13-200.fc24
2016-12-13 02:28:46
[SECURITY] Fedora 23 Update: kernel-4.8.13-100.fc23
2016-12-13 04:22:46
archlinux
archlinux
[ASA-201702-17] linux: multiple issues
2017-02-22 00:00:00
[ASA-201702-18] linux-zen: multiple issues
2017-02-22 00:00:00
oraclelinux
oraclelinux
Unbreakable Enterprise kernel security update
2017-02-06 00:00:00
kernel security, bug fix, and enhancement update
2017-03-27 00:00:00
kernel security, bug fix, and enhancement update
2017-08-15 00:00:00
centos
centos
kernel, perf, python security update
2017-03-24 15:34:16
kernel, perf, python security update
2017-08-24 01:38:33
redhat
redhat
(RHSA-2017:0817) Moderate: kernel security, bug fix, and enhancement update
2017-03-21 08:09:43
(RHSA-2017:2669) Important: kernel-rt security and bug fix update
2017-09-06 20:24:03
virtuozzo
virtuozzo
osv
osv
linux - security update
2017-01-01 00:00:00
debian
debian
[SECURITY] [DLA 772-1] linux security update
2017-01-01 18:24:51
ibm
ibm