CVE-2017-1000363: High severity linux kernel vulnerability
Last updated 29 November 2024
Other sources
Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missing bounds check, and the fact that parportptr integer is static, a 'secure boot' kernel command line adversary (can happen due to bootloader vulns, e.g. Google Nexus 6's CVE-2016-10277, where due to a vulnerability the adversary has partial control over the command line) can overflow the parportnr array in the following code, by appending many (>LPNO) 'lp=none' arguments to the command line.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2017-1000363.
What is the severity of CVE-2017-1000363?
The severity of CVE-2017-1000363 is high.
How does CVE-2017-1000363 occur?
CVE-2017-1000363 occurs due to a missing bounds check in Linux drivers/char/lp.c.
Which versions of Linux are affected by CVE-2017-1000363?
Linux versions 3.13.0-123.172, 4.4.0-83.106, 4.8.0-58.63, 4.10.0-26.30, and 4.12~ are affected by CVE-2017-1000363.
How can I fix CVE-2017-1000363?
To fix CVE-2017-1000363, update your Linux kernel to version 3.13.0-123.172, 4.4.0-83.106, 4.8.0-58.63, 4.10.0-26.30, or 4.12~.