CVE-2017-7482: Integer Overflow
In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. This could possibly lead to memory corruption and possible privilege escalation.
Other sources
When a kerberos 5 ticket is being decoded so that it can be loaded into an rxrpc-type key, the length of a variable-length field is checked to make sure that it's not going to overrun the allocated buffer space.
The data is padded to the nearest four-byte boundary and the code doesn't check for this extra four-byte aligned padding. This can lead to the size-remaining variable wrapping and the data pointer accessing or reading past the end of the buffer. The read functionality could allow for a 3 byte infoleak and the write flaw could allow for an uncontrolled 3 byte write to kernels slab memory. This could lead to memory corruption and possible privilege escalation although no known exploit exists at the time of writing.
Discussion an a CVE-ID assignment:
http://seclists.org/oss-sec/2017/q2/602
Upstream fix https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f2f97656ada8d811d3c1bef503ced266fcd53a0
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7482?
The severity of CVE-2017-7482 is medium.
How does CVE-2017-7482 affect Linux kernel?
CVE-2017-7482 affects the Linux kernel before version 4.12.
What is the impact of CVE-2017-7482?
CVE-2017-7482 could lead to memory corruption and possible exploitation.
How can I fix CVE-2017-7482?
To fix CVE-2017-7482, you should update your Linux kernel to version 4.12 or later.
Where can I find more information about CVE-2017-7482?
You can find more information about CVE-2017-7482 in the references provided: [1], [2], [3].