UBUNTU-CVE-2017-9986: High severity ubuntu/linux vulnerability

Q: Who can exploit this issue?

A local user with low privileges can exploit it. The vulnerability is in the Linux kernel sound/oss/msnd_pinnacle.c code path, so remote network access is not required.

Q: What impact could successful exploitation have?

Successful exploitation can cause a denial of service through an over-boundary access. The advisory also states that other unspecified impact may be possible, and the listed severity vector includes high confidentiality, integrity, and availability impact.

Q: What condition is required to trigger the flaw?

An attacker must be able to change a message queue head-pointer value between two reads of that value by the kernel. This race condition is described as a double-fetch vulnerability.

Q: Which Ubuntu kernel package families are listed as affected?

The listed software includes ubuntu/linux, ubuntu/linux-aws, ubuntu/linux-fips, ubuntu/linux-lts-xenial, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-hwe, and ubuntu/linux-kvm.

Published Jun 28, 2017

Updated

The intr function in sound/oss/msndpinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a "double fetch" vulnerability.

Affected Software

18 affected componentsFixes available

ubuntu/linux<3.13.0-220.271

3.13.0-220.271

ubuntu/linux-aws*

ubuntu/linux-lts-xenial*

ubuntu/linux-azure<4.13.0-1005.7

4.13.0-1005.7

ubuntu/linux-gcp<4.13.0-1002.5

4.13.0-1002.5

ubuntu/linux-hwe<4.13.0-32.35~16.04.1

4.13.0-32.35~16.04.1

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-kvm*

ubuntu/linux-fips*

ubuntu/linux-snapdragon<4.15.0-1053.57

4.15.0-1053.57

ubuntu/linux-azure-fde*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 3.13.0-220.271
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.13.0-1005.7
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.13.0-1002.5
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.13.0-32.35~16.04.1
Upgrade
Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.
Fixed in 4.15.0-1053.57

Event History

Jun 28, 2017

CVE Published

via OSV·06:29 AM

Data Sourced

via OSV·06:29 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

A local user with low privileges can exploit it. The vulnerability is in the Linux kernel sound/oss/msnd_pinnacle.c code path, so remote network access is not required.

What impact could successful exploitation have?

Successful exploitation can cause a denial of service through an over-boundary access. The advisory also states that other unspecified impact may be possible, and the listed severity vector includes high confidentiality, integrity, and availability impact.

What condition is required to trigger the flaw?

An attacker must be able to change a message queue head-pointer value between two reads of that value by the kernel. This race condition is described as a double-fetch vulnerability.

Which Ubuntu kernel package families are listed as affected?

The listed software includes ubuntu/linux, ubuntu/linux-aws, ubuntu/linux-fips, ubuntu/linux-lts-xenial, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-hwe, and ubuntu/linux-kvm.

UBUNTU-CVE-2017-9986: High severity ubuntu/linux vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What impact could successful exploitation have?

What condition is required to trigger the flaw?

Which Ubuntu kernel package families are listed as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What impact could successful exploitation have?

What condition is required to trigger the flaw?

Which Ubuntu kernel package families are listed as affected?