Ubuntu.comUB:CVE-2017-5967CVE-2017-5967
4 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
29.5%
The time subsystem in the Linux kernel through 4.9.9, when
CONFIG_TIMER_STATS is enabled, allows local users to discover real PID
values (as distinguished from PID values inside a PID namespace) by reading
the /proc/timer_list file, related to the print_timer function in
kernel/time/timer_list.c and the __timer_stats_timer_set_start_info
function in kernel/time/timer.c.
Notes
| Author | Note |
|---|---|
| sbeattie | patch disables/removes CONFIG_TIMER_STATS entirely. |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 16.04 | noarch | linux | < 4.4.0-207.239 | UNKNOWN |
| ubuntu | 14.04 | noarch | linux-aws | < 4.4.0-1090.94) Available with Ubuntu Pro or Ubuntu Pro (Infra-only | UNKNOWN |
| ubuntu | 16.04 | noarch | linux-aws | < 4.4.0-1126.140 | UNKNOWN |
| ubuntu | 16.04 | noarch | linux-gcp | < 4.13.0-1002.5 | UNKNOWN |
| ubuntu | 16.04 | noarch | linux-hwe | < 4.13.0-26.29~16.04.2 | UNKNOWN |
| ubuntu | 16.04 | noarch | linux-hwe-edge | < 4.13.0-26.29~16.04.2 | UNKNOWN |
| ubuntu | 16.04 | noarch | linux-kvm | < 4.4.0-1091.100 | UNKNOWN |
| ubuntu | 14.04 | noarch | linux-lts-xenial | < 4.4.0-208.240~14.04.1) Available with Ubuntu Pro or Ubuntu Pro (Infra-only | UNKNOWN |
| ubuntu | 16.04 | noarch | linux-raspi2 | < 4.4.0-1150.161 | UNKNOWN |
| ubuntu | 18.04 | noarch | linux-snapdragon | < 4.15.0-1053.57 | UNKNOWN |
References
git.kernel.org/cgit/linux/kernel/git/tip/tip.git/commit/?id=dfb4357da6ddbdf57d583ba64361c9d792b0e0b1
bugzilla.kernel.org/show_bug.cgi?id=193921
launchpad.net/bugs/cve/CVE-2017-5967
nvd.nist.gov/vuln/detail/CVE-2017-5967
security-tracker.debian.org/tracker/CVE-2017-5967
ubuntu.com/security/notices/USN-4904-1
www.cve.org/CVERecord?id=CVE-2017-5967
Related
4 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
29.5%