CVE-2017-14954 — MEDIUM (5.5)

Q: How severe is CVE-2017-14954?

CVE-2017-14954 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2017-14954?

Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel.

Vulnerability Description

The waitid implementation in kernel/exit.c in the Linux kernel through 4.13.4 accesses rusage data structures in unintended cases, which allows local users to obtain sensitive information, and bypass the KASLR protection mechanism, via a crafted system call.

CVSS Score

5.5

MEDIUM

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Linux	Linux Kernel	<= 4.13.4

Related Weaknesses (CWE)

CWE-200

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6c8550Issue TrackingPatchThird Party Advisory
https://github.com/torvalds/linux/commit/6c85501f2fabcfc4fc6ed976543d252c4eaf4beIssue TrackingPatchThird Party Advisory
https://grsecurity.net/~spender/exploits/wait_for_kaslr_to_be_effective.cThird Party Advisory
https://twitter.com/_argp/status/914021130712870912Third Party Advisory
https://twitter.com/grsecurity/status/914079864478666753Third Party Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6c8550Issue TrackingPatchThird Party Advisory
https://github.com/torvalds/linux/commit/6c85501f2fabcfc4fc6ed976543d252c4eaf4beIssue TrackingPatchThird Party Advisory
https://grsecurity.net/~spender/exploits/wait_for_kaslr_to_be_effective.cThird Party Advisory
https://twitter.com/_argp/status/914021130712870912Third Party Advisory
https://twitter.com/grsecurity/status/914079864478666753Third Party Advisory

FAQ

What is CVE-2017-14954?

CVE-2017-14954 is a vulnerability with a CVSS score of 5.5 (MEDIUM). The waitid implementation in kernel/exit.c in the Linux kernel through 4.13.4 accesses rusage data structures in unintended cases, which allows local users to obtain sensitive information, and bypass ...

How severe is CVE-2017-14954?

CVE-2017-14954 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-14954?

Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel.