Vulnerability Description
The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | <= 4.13.7 |
Related Weaknesses (CWE)
References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2b04e8Issue TrackingPatchVendor Advisory
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=95d78cIssue TrackingPatchVendor Advisory
- http://seclists.org/oss-sec/2017/q4/52Issue TrackingMailing ListThird Party Advisory
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.8Issue TrackingThird Party Advisory
- http://www.securityfocus.com/bid/101911Issue TrackingThird Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:0654
- https://access.redhat.com/errata/RHSA-2018:0676
- https://access.redhat.com/errata/RHSA-2018:1062
- https://access.redhat.com/errata/RHSA-2018:1854
- https://access.redhat.com/errata/RHSA-2019:1170
- https://access.redhat.com/errata/RHSA-2019:1190
- https://bugzilla.redhat.com/show_bug.cgi?id=1495089Issue TrackingPatchThird Party Advisory
- https://github.com/torvalds/linux/commit/2b04e8f6bbb196cab4b232af0f8d48ff2c7a805Issue TrackingPatchThird Party Advisory
- https://github.com/torvalds/linux/commit/95d78c28b5a85bacbc29b8dba7c04babb9b0d46Issue TrackingPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html
FAQ
What is CVE-2017-12190?
CVE-2017-12190 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same ...
How severe is CVE-2017-12190?
CVE-2017-12190 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-12190?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel.