CVE-2017-18595: Use After Free
First published: Wed Sep 04 2019(Updated: )
A flaw was found in the allocate_trace_buffer in kernel/trace/trace.c in the debug subsystem, when failure to allocate a dynamic percpu area, a resource cleanup is called. The pointer (buf->buffer) still holds the address and is not set to NULL, which can cause a use-after-free problem, leading to a dangling pointer issue.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel-rt | <0:3.10.0-1127.8.2.rt56.1103.el7 | 0:3.10.0-1127.8.2.rt56.1103.el7 |
| redhat/kernel | <0:3.10.0-1127.8.2.el7 | 0:3.10.0-1127.8.2.el7 |
| redhat/kernel-alt | <0:4.14.0-115.21.2.el7a | 0:4.14.0-115.21.2.el7a |
| redhat/kernel | <0:3.10.0-327.88.1.el7 | 0:3.10.0-327.88.1.el7 |
| redhat/kernel | <0:3.10.0-514.76.1.el7 | 0:3.10.0-514.76.1.el7 |
| redhat/kernel | <0:3.10.0-693.67.1.el7 | 0:3.10.0-693.67.1.el7 |
| redhat/kernel | <0:3.10.0-957.54.1.el7 | 0:3.10.0-957.54.1.el7 |
| redhat/kernel | <0:3.10.0-1062.26.1.el7 | 0:3.10.0-1062.26.1.el7 |
| redhat/kernel-rt | <1:3.10.0-693.67.1.rt56.665.el6 | 1:3.10.0-693.67.1.rt56.665.el6 |
| Linux Linux kernel | <4.14.11 | |
| openSUSE Leap | =15.0 | |
| openSUSE Leap | =15.1 | |
| Linux Linux kernel | >=3.10<3.16.55 | |
| Linux Linux kernel | >=3.17<3.18.91 | |
| Linux Linux kernel | >=3.19<4.1.50 | |
| Linux Linux kernel | >=4.2<4.4.109 | |
| Linux Linux kernel | >=4.5<4.9.74 | |
| Linux Linux kernel | >=4.10<4.14.11 |
Remedy
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00037.html
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.11
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4397f04575c44e1440ec2e49b6302785c95fd2f8
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1759138
- https://access.redhat.com/errata/RHSA-2020:2104
- https://access.redhat.com/security/cve/cve-2017-18595
- https://access.redhat.com/errata/RHSA-2020:2082
- https://access.redhat.com/errata/RHSA-2020:2085
- https://access.redhat.com/errata/RHSA-2020:2214
- https://access.redhat.com/errata/RHSA-2020:2242
- https://access.redhat.com/errata/RHSA-2020:2285
- https://access.redhat.com/errata/RHSA-2020:2277
- https://access.redhat.com/errata/RHSA-2020:2289
- https://access.redhat.com/errata/RHSA-2020:2522
- https://bugzilla.redhat.com/show_bug.cgi?id=1758671
- https://www.cve.org/CVERecord?id=CVE-2017-18595 https://nvd.nist.gov/vuln/detail/CVE-2017-18595
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-18595
- agent/severity
- agent/remedy
- agent/references
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- agent/weakness
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- agent/trending
- package-manager/redhat
- vendor/linux
- canonical/linux linux kernel
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/15.0
- version/opensuse leap/15.1
- version/linux linux kernel/3.10
- version/linux linux kernel/3.17
- version/linux linux kernel/3.19
- version/linux linux kernel/4.2
- version/linux linux kernel/4.5
- version/linux linux kernel/4.10