CVE-2017-17053
published 2017-11-29CVE-2017-17053: The init_new_context function in arch/x86/include/asm/mmu_context.h in the Linux kernel before 4.12.10 does not correctly handle errors from LDT table…
PriorityP429high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.38%
30.4th percentile
The init_new_context function in arch/x86/include/asm/mmu_context.h in the Linux kernel before 4.12.10 does not correctly handle errors from LDT table allocation when forking a new process, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program. This vulnerability only affected kernels built with CONFIG_MODIFY_LDT_SYSCALL=y.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.12.12-1 (bookworm) | linux 4.12.12-1 (bookworm) |
| linux | linux_kernel | >= 0 < 4.12.12-1 | 4.12.12-1 |
| linux | linux_kernel | >= 0 < 4.12.12-1 | 4.12.12-1 |
| linux | linux_kernel | >= 0 < 4.12.12-1 | 4.12.12-1 |
| linux | linux_kernel | >= 0 < 4.12.12-1 | 4.12.12-1 |
| linux | linux_kernel | >= 4.10 < 4.12.10 | 4.12.10 |
| linux | linux_kernel | >= 4.4.144 < 4.4.153 | 4.4.153 |
| linux | linux_kernel | >= 4.6 < 4.9.46 | 4.9.46 |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv7.0HIGH
vendor_debian7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qv5h-fq2w-c68j: The init_new_context function in arch/x86/include/asm/mmu_context
ghsa_unreviewed·2022-05-14
CVE-2017-17053 [HIGH] CWE-416 GHSA-qv5h-fq2w-c68j: The init_new_context function in arch/x86/include/asm/mmu_context
The init_new_context function in arch/x86/include/asm/mmu_context.h in the Linux kernel before 4.12.10 does not correctly handle errors from LDT table allocation when forking a new process, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program. This vulnerability only affected kernels built with CONFIG_MODIFY_LDT_SYSCALL=y.
Kernel
x86/mm/32: Bring back vmalloc faulting on x86_32
kernel_security·2020-09-02
x86/mm/32: Bring back vmalloc faulting on x86_32
x86/mm/32: Bring back vmalloc faulting on x86_32
One can not simply remove vmalloc faulting on x86-32. Upstream
commit: 7f0a002b5a21 ("x86/mm: remove vmalloc faulting")
removed it on x86 alltogether because previously the
arch_sync_kernel_mappings() interface was introduced. This interface
added synchronization of vmalloc/ioremap page-table updates to all
page-tables in the system at creation time and was thought to make
vmalloc faulting obsolete.
But that assumption was incredibly naive.
It turned out that there is a race window between the time the vmalloc
or ioremap code establishes a mapping and the time it synchronizes
this change to other page-tables in the system.
During this race window another CPU or thread can establish a vmalloc
mapping which uses the same intermediate pag
OSV
CVE-2017-17053: The init_new_context function in arch/x86/include/asm/mmu_context
osv·2017-11-29·CVSS 7.0
CVE-2017-17053 [HIGH] CVE-2017-17053: The init_new_context function in arch/x86/include/asm/mmu_context
The init_new_context function in arch/x86/include/asm/mmu_context.h in the Linux kernel before 4.12.10 does not correctly handle errors from LDT table allocation when forking a new process, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program. This vulnerability only affected kernels built with CONFIG_MODIFY_LDT_SYSCALL=y.
Red Hat
kernel: Incorrect handling in arch/x86/include/asm/mmu_context.h:init_new_context function allowing use-after-free
vendor_redhat·2017-08-24·CVSS 7.0
CVE-2017-17053 [HIGH] CWE-252 kernel: Incorrect handling in arch/x86/include/asm/mmu_context.h:init_new_context function allowing use-after-free
kernel: Incorrect handling in arch/x86/include/asm/mmu_context.h:init_new_context function allowing use-after-free
The init_new_context function in arch/x86/include/asm/mmu_context.h in the Linux kernel before 4.12.10 does not correctly handle errors from LDT table allocation when forking a new process, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program. This vulnerability only affected kernels built with CONFIG_MODIFY_LDT_SYSCALL=y.
The init_new_context function in arch/x86/include/asm/mmu_context.h in the Linux kernel, before 4.12.10, does not correctly handle errors from LDT table allocation when forking a new process. This could allow a local attacker to achieve a use-after-free or possibly have unspe
Debian
CVE-2017-17053: linux - The init_new_context function in arch/x86/include/asm/mmu_context.h in the Linux...
vendor_debian·2017·CVSS 7.0
CVE-2017-17053 [HIGH] CVE-2017-17053: linux - The init_new_context function in arch/x86/include/asm/mmu_context.h in the Linux...
The init_new_context function in arch/x86/include/asm/mmu_context.h in the Linux kernel before 4.12.10 does not correctly handle errors from LDT table allocation when forking a new process, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program. This vulnerability only affected kernels built with CONFIG_MODIFY_LDT_SYSCALL=y.
Scope: local
bookworm: resolved (fixed in 4.12.12-1)
bullseye: resolved (fixed in 4.12.12-1)
forky: resolved (fixed in 4.12.12-1)
sid: resolved (fixed in 4.12.12-1)
trixie: resolved (fixed in 4.12.12-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-17053 kernel: Incorrect handling in arch/x86/include/asm/mmu_context.h:init_new_context function allowing use-after-free
bugzilla·2017-11-29·CVSS 7.0
CVE-2017-17053 [HIGH] CVE-2017-17053 kernel: Incorrect handling in arch/x86/include/asm/mmu_context.h:init_new_context function allowing use-after-free
CVE-2017-17053 kernel: Incorrect handling in arch/x86/include/asm/mmu_context.h:init_new_context function allowing use-after-free
The init_new_context function in arch/x86/include/asm/mmu_context.h in the Linux kernel before 4.12.10 does not correctly handle errors from LDT table allocation when forking a new process, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program.
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ccd5b3235180eef3cfec337df1c8554ab151b5cc
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1518642]
---
Fedora hasn't supported a 4.12.x kernel in quite some time. Current kernels are 4.13.16 across all supp
Bugzilla
CVE-2017-17052 CVE-2017-17053 kernel: various flaws [fedora-all]
bugzilla·2017-11-29·CVSS 7.8
CVE-2017-17052 [HIGH] CVE-2017-17052 CVE-2017-17053 kernel: various flaws [fedora-all]
CVE-2017-17052 CVE-2017-17053 kernel: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. W
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ccd5b3235180eef3cfec337df1c8554ab151b5cchttp://www.securityfocus.com/bid/102010https://access.redhat.com/errata/RHSA-2018:0676https://github.com/torvalds/linux/commit/ccd5b3235180eef3cfec337df1c8554ab151b5cchttps://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.10http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ccd5b3235180eef3cfec337df1c8554ab151b5cchttp://www.securityfocus.com/bid/102010https://access.redhat.com/errata/RHSA-2018:0676https://github.com/torvalds/linux/commit/ccd5b3235180eef3cfec337df1c8554ab151b5cchttps://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.10
2017-11-29
Published