CVE-2017-7889: High severity Linux Linux kernel vulnerability
Last updated 4 July 2026
Other sources
The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIGSTRICTDEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file, related to arch/x86/mm/init.c and drivers/char/mem.c.
— Launchpad
The mm subsystem in the Linux kernel through 4.10.10 does not properly enforce the CONFIGSTRICTDEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file, related to arch/x86/mm/init.c and drivers/char/mem.c.
Discussion:
http://seclists.org/oss-sec/2017/q2/76
Upstream patch:
https://github.com/torvalds/linux/commit/a4866aa812518ed1a37d8ea0c881dc946409de94
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 6.12.111-1Fixed in 7.2.9-1Fixed in 7.2.10-1 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 4.10.10Patch a4866aa812518ed1a37d8ea0c881dc946409de94 - Compensating control
If you cannot immediately patch, prevent untrusted/local users from being able to open /dev/mem (e.g., remove access via OS permissions/ACLs or restrict the ability to run the needed application to trusted users only).
Event History
Frequently Asked Questions
What is CVE-2017-7889?
CVE-2017-7889 is a vulnerability in the Linux kernel that allows local users to read or write to kernel memory locations in the first megabyte through the CONFIG_STRICT_DEVMEM protection mechanism.
What is the severity level of CVE-2017-7889?
CVE-2017-7889 has a severity level of medium.
How does CVE-2017-7889 affect Linux systems?
CVE-2017-7889 affects Linux systems running kernel versions through 3.2 that do not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism.
How can I fix CVE-2017-7889 vulnerability?
To fix the CVE-2017-7889 vulnerability, update your Linux kernel to version 4.11 or higher.
Where can I find more information about CVE-2017-7889?
You can find more information about CVE-2017-7889 at the following references: [http://seclists.org/oss-sec/2017/q2/76](http://seclists.org/oss-sec/2017/q2/76), [https://github.com/torvalds/linux/commit/a4866aa812518ed1a37d8ea0c881dc946409de94](https://github.com/torvalds/linux/commit/a4866aa812518ed1a37d8ea0c881dc946409de94), [https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1444496](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1444496).