CVE-2017-14340: Null Pointer Dereference
It was found that XFS filesystem code mishandles a user settable inode flag in the Linux kernels prior to 4.14-rc1 which can cause a local denial of service via a kernel panic.
External References:
http://seclists.org/oss-sec/2017/q3/436
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b31ff3cdf540110da4572e3e29bd172087af65cc
Other sources
The XFSISREALTIMEINODE macro in fs/xfs/xfslinux.h in the Linux kernel before 4.13.2 does not verify that a filesystem has a realtime device, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via vectors related to setting an RHINHERIT flag on a directory.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14340?
CVE-2017-14340 has a severity rating of medium, as it can lead to a local denial of service via a kernel panic.
How do I fix CVE-2017-14340?
To fix CVE-2017-14340, update to a Linux kernel version that is 4.14-rc1 or later.
Which versions of Linux are affected by CVE-2017-14340?
CVE-2017-14340 affects Linux kernel versions up to and including 4.13.1.
What is the impact of not patching CVE-2017-14340?
Failure to patch CVE-2017-14340 may result in system instability and potential denial of service.
Who is affected by CVE-2017-14340?
Any user operating an affected version of the Linux kernel could potentially experience a local denial of service due to CVE-2017-14340.