CVE-2017-12193: Null Pointer Dereference
A flaw was found in the Linux kernels implementation of associative arrays introduced in 3.13. The Red Hat Enterprise Linux 7 kernel had back ported this functionality to the 3.10 kernels and was affected by this flaw. The flaw involved a null pointer dereference in assocarrayapplyedit() due to incorrect node-splitting in assocarray implementation. This did not affect all callers of of the associative array code, only those that would try todereference the assigned value, a kernel panic will occur.
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ea6789980fdaa610d7eb63602c746bf6ec70cd2b
Oss-security: http://seclists.org/oss-sec/2017/q4/181
Other sources
The assocarrayinsertintoterminalnode function in lib/assocarray.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.94-1Fixed in 6.12.107-1Fixed in 7.1.12-1Fixed in 7.1.13-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 4.13.11
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12193?
The severity of CVE-2017-12193 is considered moderate due to the potential for a null pointer dereference.
How do I fix CVE-2017-12193?
To fix CVE-2017-12193, you should upgrade to a patched version of the Linux kernel beyond 4.13.11.
Which Linux kernel versions are affected by CVE-2017-12193?
CVE-2017-12193 affects Linux kernel versions prior to 4.13.11, including backported versions in Red Hat Enterprise Linux 7.
What is the impact of CVE-2017-12193?
The impact of CVE-2017-12193 is a potential system crash due to a null pointer dereference in the associative arrays implementation.
Is CVE-2017-12193 specific to any Linux distributions?
CVE-2017-12193 is particularly noted in the Red Hat Enterprise Linux 7 kernel but may affect other distributions using the vulnerable kernel versions.