Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missing bounds check, and the fact that parport_ptr integer is static, a 'secure boot' kernel command line adversary (can happen due to bootloader vulns, e.g. Google Nexus 6's CVE-2016-10277, where due to a vulnerability the adversary has partial control over the command line) can overflow the parport_nr array in the following code, by appending many (>LP_NO) 'lp=none' arguments to the command line.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | suse-upgrade-kernel-defaultsuse-upgrade-kernel-docssuse-upgrade-kernel-ec2suse-upgrade-kernel-ec2-develsuse-upgrade-kernel-ec2-extra | Sep 8, 2017 | Jul 17, 2017 |
| Ubuntu | ubuntu-upgrade-linux-image-3-13-0-123-genericubuntu-upgrade-linux-image-3-13-0-123-generic-lpaeubuntu-upgrade-linux-image-3-13-0-123-lowlatencyubuntu-upgrade-linux-image-3-13-0-123-powerpc-e500ubuntu-upgrade-linux-image-3-13-0-123-powerpc-e500mcubuntu-upgrade-linux-image-3-13-0-123-powerpc-smpubuntu-upgrade-linux-image-3-13-0-123-powerpc64-embubuntu-upgrade-linux-image-3-13-0-123-powerpc64-smpubuntu-upgrade-linux-image-4-10-0-1010-raspi2ubuntu-upgrade-linux-image-4-10-0-26-genericubuntu-upgrade-linux-image-4-10-0-26-generic-lpaeubuntu-upgrade-linux-image-4-10-0-26-lowlatencyubuntu-upgrade-linux-image-4-4-0-1018-gkeubuntu-upgrade-linux-image-4-4-0-1022-awsubuntu-upgrade-linux-image-4-4-0-1061-raspi2ubuntu-upgrade-linux-image-4-4-0-1063-snapdragonubuntu-upgrade-linux-image-4-4-0-83-genericubuntu-upgrade-linux-image-4-4-0-83-generic-lpaeubuntu-upgrade-linux-image-4-4-0-83-lowlatencyubuntu-upgrade-linux-image-4-4-0-83-powerpc-e500mcubuntu-upgrade-linux-image-4-4-0-83-powerpc-smpubuntu-upgrade-linux-image-4-4-0-83-powerpc64-embubuntu-upgrade-linux-image-4-4-0-83-powerpc64-smpubuntu-upgrade-linux-image-4-8-0-1042-raspi2ubuntu-upgrade-linux-image-4-8-0-58-genericubuntu-upgrade-linux-image-4-8-0-58-generic-lpaeubuntu-upgrade-linux-image-4-8-0-58-lowlatencyubuntu-upgrade-linux-image-4-8-0-58-powerpc-e500mcubuntu-upgrade-linux-image-4-8-0-58-powerpc-smpubuntu-upgrade-linux-image-4-8-0-58-powerpc64-embubuntu-upgrade-linux-image-awsubuntu-upgrade-linux-image-genericubuntu-upgrade-linux-image-generic-hwe-16-04ubuntu-upgrade-linux-image-generic-lpaeubuntu-upgrade-linux-image-generic-lpae-hwe-16-04ubuntu-upgrade-linux-image-generic-lpae-lts-trustyubuntu-upgrade-linux-image-generic-lpae-lts-xenialubuntu-upgrade-linux-image-generic-lts-trustyubuntu-upgrade-linux-image-generic-lts-xenialubuntu-upgrade-linux-image-gkeubuntu-upgrade-linux-image-lowlatencyubuntu-upgrade-linux-image-lowlatency-hwe-16-04ubuntu-upgrade-linux-image-lowlatency-lts-xenialubuntu-upgrade-linux-image-powerpc-e500ubuntu-upgrade-linux-image-powerpc-e500mcubuntu-upgrade-linux-image-powerpc-e500mc-lts-xenialubuntu-upgrade-linux-image-powerpc-smpubuntu-upgrade-linux-image-powerpc-smp-lts-xenialubuntu-upgrade-linux-image-powerpc64-embubuntu-upgrade-linux-image-powerpc64-emb-lts-xenialubuntu-upgrade-linux-image-powerpc64-smpubuntu-upgrade-linux-image-powerpc64-smp-lts-xenialubuntu-upgrade-linux-image-raspi2ubuntu-upgrade-linux-image-snapdragonubuntu-upgrade-linux-image-virtual | Dec 20, 2017 | Jun 29, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub