CVE-2017-9605: Infoleak
Last updated 29 November 2024
Other sources
The vmwgbsurfacedefineioctl function (accessible via DRMIOCTLVMWGBSURFACECREATE) in drivers/gpu/drm/vmwgfx/vmwgfxsurface.c in the Linux kernel through 4.11.4 defines a backuphandle variable but does not give it an initial value. If one attempts to create a GB surface, with a previously allocated DMA buffer to be used as a backup buffer, the backuphandle variable does not get written to and is then later returned to user space, allowing local users to obtain sensitive information from uninitialized kernel memory via a crafted ioctl call.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2017-9605?
CVE-2017-9605 is a vulnerability in the Linux kernel that allows an attacker to read uninitialized kernel memory.
How does CVE-2017-9605 affect Linux?
CVE-2017-9605 affects the Linux kernel versions up to and including 4.11.4.
Is there a fix available for CVE-2017-9605?
Yes, the fix for CVE-2017-9605 is included in Linux kernel version 4.12 and above.
What should I do to fix CVE-2017-9605?
To fix CVE-2017-9605, update your Linux kernel to version 4.12 or above.
Where can I find more information about CVE-2017-9605?
You can find more information about CVE-2017-9605 at the following references: [1](http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=07678eca2cf9c9a18584e546c2b2a0d0c9a3150c), [2](https://github.com/torvalds/linux/commit/07678eca2cf9c9a18584e546c2b2a0d0c9a3150c), [3](http://www.securityfocus.com/bid/99095)