CVE-2017-15121 — MEDIUM (5.5)

Vulnerability Description

A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that does not end aligned to a page boundary.

CVSS Score

5.5

MEDIUM

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Redhat	Enterprise Linux	6.0
Redhat	Enterprise Linux Desktop	6.0
Redhat	Enterprise Linux Server	6.0
Redhat	Enterprise Linux Server Aus	7.6
Redhat	Enterprise Linux Server Eus	7.6
Redhat	Enterprise Linux Server Tus	7.6
Redhat	Enterprise Linux Workstation	6.0

Related Weaknesses (CWE)

CWE-20

References

http://www.securityfocus.com/bid/102128Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:0676Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:1062Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:1854Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1520893Issue TrackingVendor Advisory
https://support.f5.com/csp/article/K42142782?utm_source=f5support&amp%3Butm_medi
http://www.securityfocus.com/bid/102128Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:0676Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:1062Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:1854Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1520893Issue TrackingVendor Advisory
https://support.f5.com/csp/article/K42142782?utm_source=f5support&amp%3Butm_medi

FAQ

What is CVE-2017-15121?

CVE-2017-15121 is a vulnerability with a CVSS score of 5.5 (MEDIUM). A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that does not end aligned to a page boundary.

How severe is CVE-2017-15121?

CVE-2017-15121 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-15121?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus, Redhat Enterprise Linux Server Eus.