CVE-2017-1000380: Infoleak

Q: What is CVE-2017-1000380?

CVE-2017-1000380 is a vulnerability in the Linux kernel before version 4.11.5 that allows local users to read information belonging to other users.

Q: How does CVE-2017-1000380 work?

CVE-2017-1000380 works by exploiting a data race in the ALSA /dev/snd/timer driver, which can lead to the disclosure of uninitialized memory contents.

Q: What is the severity of CVE-2017-1000380?

CVE-2017-1000380 has a severity level of medium.

Q: Is there a fix for CVE-2017-1000380?

Yes, the fix for CVE-2017-1000380 is available in Linux kernel version 4.11.5 and later.

Q: Where can I find more information about CVE-2017-1000380?

You can find more information about CVE-2017-1000380 in the Linux kernel's git repository and the change log for version 4.11.5.

Published Jun 17, 2017

Updated

A information leak was found in /dev/snd/timer driver which was prone to a data race, leading to uninitialized memory from the kernel heap being copied to user space. A local user with access to /dev/snd/timer could use this flaw to read kernel space memory of other users.

References:

http://seclists.org/oss-sec/2017/q2/455

https://bugzilla.suse.com/showbug.cgi?id=1044125

CVE-ID assignment:

http://seclists.org/oss-sec/2017/q2/463

Upstream patches:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d11662f4f798b50d8c8743f433842c3e40fe3378

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ba3021b2c79b2fa9114f92790a99deb27a65b728

Other sources

sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time.

— Launchpad

Affected Software

23 affected componentsFixes available

Linux Linux kernel<=4.11.4

ubuntu/linux<3.13.0-125.174

3.13.0-125.174

ubuntu/linux-lts-xenial<4.4.0-87.110~14.04.1

4.4.0-87.110~14.04.1

ubuntu/linux<4.4.0-87.110

4.4.0-87.110

ubuntu/linux-aws<4.4.0-1026.35

4.4.0-1026.35

ubuntu/linux-gke<4.4.0-1022.22

4.4.0-1022.22

ubuntu/linux-hwe<4.10.0-32.36~16.04.1

4.10.0-32.36~16.04.1

ubuntu/linux-raspi2<4.4.0-1065.73

4.4.0-1065.73

ubuntu/linux-snapdragon<4.4.0-1067.72

4.4.0-1067.72

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15*

ubuntu/linux-gke*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-azure-6.11*

ubuntu/linux-gcp-6.11*

ubuntu/linux-hwe-6.11*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-raspi-realtime*

debian/linux

6.1.176-16.1.190-16.12.107-16.12.116-17.2.15-17.3.4-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 3.13.0-125.174
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-87.110~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-87.110
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1026.35
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 4.4.0-1022.22
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.10.0-32.36~16.04.1
Upgrade
Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.
Fixed in 4.4.0-1065.73
Upgrade
Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.
Fixed in 4.4.0-1067.72
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1
Upgrade
Upgrade Linux kernel to a version that resolves this vulnerability.
Fixed in 4.11.5

Event History

Jun 17, 2017

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Jun 20, 2017

Data Sourced

via Red Hat·02:37 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-3981

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-1099-1

Frequently Asked Questions

What is CVE-2017-1000380?

CVE-2017-1000380 is a vulnerability in the Linux kernel before version 4.11.5 that allows local users to read information belonging to other users.

How does CVE-2017-1000380 work?

CVE-2017-1000380 works by exploiting a data race in the ALSA /dev/snd/timer driver, which can lead to the disclosure of uninitialized memory contents.

What is the severity of CVE-2017-1000380?

CVE-2017-1000380 has a severity level of medium.

Is there a fix for CVE-2017-1000380?

Yes, the fix for CVE-2017-1000380 is available in Linux kernel version 4.11.5 and later.

Where can I find more information about CVE-2017-1000380?

You can find more information about CVE-2017-1000380 in the Linux kernel's git repository and the change log for version 4.11.5.

CVE-2017-1000380: Infoleak

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is CVE-2017-1000380?

How does CVE-2017-1000380 work?

What is the severity of CVE-2017-1000380?

Is there a fix for CVE-2017-1000380?

Where can I find more information about CVE-2017-1000380?

Company

Resources

Contact