CVE-2017-18550

A flaw was found in drivers/scsi/aacraid/commctrl.c in the Linux kernel, where there is potential exposure of kernel stack memory because the aac_get_hba_info function, does not initialize the hbainfo structure. An attacker with relevant permissions can issue ioctl to an aacraid device.

Mitigation

There is no known mitigation to this flaw, preventing users being able to issue an ioctl to this device by removing the relevant permissions to do so will limit the information exposure.