CVE-2017-12146: Race Condition
It was found that the driveroverride implementation in base/platform.c is susceptible to race condition when different threads are reading vs storing a different driver override.
Upstream patch:
https://github.com/torvalds/linux/commit/6265539776a0810b7ce6398c27866ddb9c6bd154
Introduced by commit:
https://github.com/torvalds/linux/commit/3d713e0e382e
Other sources
The driveroverride implementation in drivers/base/platform.c in the Linux kernel before 4.12.1 allows local users to gain privileges by leveraging a race condition between a read operation and a store operation that involve different overrides.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.13 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 4.12.1
Event History
Frequently Asked Questions
What is CVE-2017-12146?
CVE-2017-12146 is a vulnerability in the Linux kernel that allows local users to gain privileges by exploiting a race condition in the driver_override implementation.
What is the severity of CVE-2017-12146?
CVE-2017-12146 has a severity level of medium.
How can I fix CVE-2017-12146?
To fix CVE-2017-12146, you should update your Linux kernel to version 4.12.1 or later.
Are there any references for CVE-2017-12146?
Yes, you can find references for CVE-2017-12146 in the following links: [Link 1](http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6265539776a0810b7ce6398c27866ddb9c6bd154), [Link 2](http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.1), [Link 3](https://bugzilla.redhat.com/show_bug.cgi?id=1489078)
What is the CWE classification for CVE-2017-12146?
CVE-2017-12146 is classified as CWE-362.