CVE-2017-14156: Infoleak

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2017-14156.

Q: What is the description of the vulnerability?

The atyfb_ioctl function in the Linux kernel through 4.12.10 does not initialize a certain data structure, allowing local users to obtain sensitive information from kernel stack memory.

Q: How does the vulnerability affect the software?

The vulnerability affects the Linux kernel versions up to 4.12.10.

Q: How can I fix the vulnerability?

To fix the vulnerability, update your Linux kernel to version 4.13.0-17.20 or later.

Q: Where can I find more information about the vulnerability?

You can find more information about the vulnerability at the following references: [link1], [link2], [link3].

Published Sep 5, 2017

Updated

Last updated 29 November 2024

Other sources

The atyfbioctl function in drivers/video/fbdev/aty/atyfbbase.c in the Linux kernel through 4.12.10 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory by reading locations associated with padding bytes.

Affected Software

26 affected componentsFixes available

Linux Linux kernel<=4.12.10

debian/linux

6.1.176-16.1.190-16.12.107-16.12.116-17.2.15-17.3.3-1

ubuntu/linux<3.13.0-142.191

3.13.0-142.191

ubuntu/linux-lts-xenial<4.4.0-98.121~14.04.1

4.4.0-98.121~14.04.1

ubuntu/linux<4.4.0-98.121

4.4.0-98.121

ubuntu/linux-aws<4.4.0-1039.48

4.4.0-1039.48

ubuntu/linux-azure<4.13.0-1005.7

4.13.0-1005.7

ubuntu/linux-gcp<4.13.0-1002.5

4.13.0-1002.5

ubuntu/linux-gke<4.4.0-1033.33

4.4.0-1033.33

ubuntu/linux-hwe<4.13.0-32.35~16.04.1

4.13.0-32.35~16.04.1

ubuntu/linux-kvm<4.4.0-1009.14

4.4.0-1009.14

ubuntu/linux-raspi2<4.4.0-1076.84

4.4.0-1076.84

ubuntu/linux-snapdragon<4.4.0-1078.83

4.4.0-1078.83

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15*

ubuntu/linux-gke*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-azure-6.11*

ubuntu/linux-gcp-6.11*

ubuntu/linux-hwe-6.11*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-raspi-realtime*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 3.13.0-142.191
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-98.121~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-98.121
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1039.48
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.13.0-1005.7
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.13.0-1002.5
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 4.4.0-1033.33
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.13.0-32.35~16.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.4.0-1009.14
Upgrade
Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.
Fixed in 4.4.0-1076.84
Upgrade
Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.
Fixed in 4.4.0-1078.83

Event History

Sep 5, 2017

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

DSA-3981

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-1099-1

Frequently Asked Questions

What is the vulnerability ID?