Veracode Vulnerability DatabaseVERACODE:18890Denial Of Service (DoS)
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.9 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:N/I:N/A:C
Linux kernel is vulnerable to denial of service attacks. A local authenticated attacker is able exhaust kernel memory via a flaw in the keyctl_set_reqkey_keyring() function leading to denial of service conditions.
References
git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c9f838d104fed6f2f61d68164712e3204bf5271b
lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html
openwall.com/lists/oss-security/2017/05/11/1
www.securityfocus.com/bid/98422
www.securitytracker.com/id/1038471
access.redhat.com/articles/3327131
access.redhat.com/errata/RHSA-2018:0151
access.redhat.com/errata/RHSA-2018:0152
access.redhat.com/errata/RHSA-2018:0181
access.redhat.com/security/cve/CVE-2015-8539
access.redhat.com/security/cve/CVE-2017-12192
access.redhat.com/security/cve/CVE-2017-12193
access.redhat.com/security/cve/CVE-2017-15649
access.redhat.com/security/cve/CVE-2017-5715
access.redhat.com/security/cve/CVE-2017-5753
access.redhat.com/security/cve/CVE-2017-5754
access.redhat.com/security/cve/CVE-2017-7472
access.redhat.com/security/updates/classification/#important
access.redhat.com/security/vulnerabilities/speculativeexecution
bugzilla.novell.com/show_bug.cgi?id=1034862
bugzilla.redhat.com/show_bug.cgi?id=1442086
bugzilla.redhat.com/show_bug.cgi?id=1519778
bugzilla.redhat.com/show_bug.cgi?id=1519780
bugzilla.redhat.com/show_bug.cgi?id=1519781
github.com/torvalds/linux/commit/c9f838d104fed6f2f61d68164712e3204bf5271b
lkml.org/lkml/2017/4/1/235
lkml.org/lkml/2017/4/3/724
www.exploit-db.com/exploits/42136/
www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.13
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.9 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:N/I:N/A:C