CVE-2017-15299: Null Pointer Dereference
A vulnerability was found in the key management subsystem of the Linux kernel. An update on an uninstantiated key could cause a kernel panic, leading to DoS.
References:
https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1499828.html
https://marc.info/?t=150654188100001&r=1&w=2
https://marc.info/?t=150783958600011&r=1&w=2
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=60ff5b2f547af3828aebafd54daded44cfb0807a
Other sources
The KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of addkey for a key that already exists but is uninstantiated, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted system call.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 7.1.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15299?
CVE-2017-15299 is classified as a medium severity vulnerability due to its potential to cause a denial of service (DoS) by triggering a kernel panic.
How does CVE-2017-15299 affect Linux kernel versions?
CVE-2017-15299 impacts Linux kernel versions up to and including 4.13.6.
How do I fix CVE-2017-15299?
To fix CVE-2017-15299, upgrade to a patched version of the Linux kernel such as 5.10.223-1 or later.
What is the potential impact of CVE-2017-15299?
The potential impact of CVE-2017-15299 is that it can lead to a kernel panic, resulting in a denial of service.
Is CVE-2017-15299 related to key management?
Yes, CVE-2017-15299 is specifically related to a vulnerability in the key management subsystem of the Linux kernel.