CVE-2017-18595: Use After Free
A flaw was found in the allocatetracebuffer in kernel/trace/trace.c in the debug subsystem, when failure to allocate a dynamic percpu area, a resource cleanup is called. The pointer (buf->buffer) still holds the address and is not set to NULL, which can cause a use-after-free problem, leading to a dangling pointer issue.
Other sources
An issue was discovered in the Linux kernel before 4.14.11. A double free may be caused by the function allocatetracebuffer in the file kernel/trace/trace.c.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2017-18595?
CVE-2017-18595 is classified as a high severity vulnerability due to the potential for a use-after-free condition that could lead to arbitrary code execution.
How do I fix CVE-2017-18595?
To fix CVE-2017-18595, update to the appropriate remedied kernel versions specified in the vulnerability details, such as 0:3.10.0-1127.8.2.rt56.1103.el7 or equivalent.
Which kernel versions are affected by CVE-2017-18595?
CVE-2017-18595 affects various kernel versions, including several 3.10.x series and some 4.x series kernels up to 4.14.11.
What systems are primarily at risk from CVE-2017-18595?
CVE-2017-18595 primarily affects Linux-based systems running vulnerable kernel versions of Red Hat and openSUSE.
What are the potential impacts of CVE-2017-18595?
The potential impacts of CVE-2017-18595 include system crashes, arbitrary code execution, and unauthorized access to sensitive data.