CVE-2017-18174
published 2018-02-11CVE-2017-18174: In the Linux kernel before 4.7, the amd_gpio_remove function in drivers/pinctrl/pinctrl-amd.c calls the pinctrl_unregister function, leading to a double free.
PriorityP341critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
3.40%
87.5th percentile
In the Linux kernel before 4.7, the amd_gpio_remove function in drivers/pinctrl/pinctrl-amd.c calls the pinctrl_unregister function, leading to a double free.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | — | — |
| linux | linux_kernel | < 4.7 | 4.7 |
| linux | linux_kernel | >= 0 < 4.4.0-141.167 | 4.4.0-141.167 |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8LOW
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2018-12-20·CVSS 9.8
CVE-2017-18174 [CRITICAL] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that a double free existed in the AMD GPIO driver in the
Linux kernel. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2017-18174)
It was discovered that an integer overrun vulnerability existed in the
POSIX timers implementation in the Linux kernel. A local attacker could use
this to cause a denial of service. (CVE-2018-12896)
Kanda Motohiro discovered that writing extended attributes to an XFS file
system in the Linux kernel in certain situations could cause an error
condition to occur. A local attacker could use this to cause a denial of
service. (CVE-2018-18690)
It was discovered that an integer
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities
vendor_ubuntu·2018-12-20·CVSS 9.8
CVE-2017-18174 [CRITICAL] Linux kernel (Xenial HWE) vulnerabilities
Title: Linux kernel (Xenial HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3848-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
It was discovered that a double free existed in the AMD GPIO driver in the
Linux kernel. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2017-18174)
It was discovered that an integer overrun vulnerability existed in the
POSIX timers implementation in the Linux kernel. A local attacker could use
this to cause a denial of service. (CVE-2018-12896)
Kanda Motohiro discovered that writing extended att
Red Hat
kernel: Double free vulnerability in drivers/pinctrl/pinctrl-amd.c:amd_gpio_remove() function can lead to kernel panic
vendor_redhat·2018-01-17·CVSS 9.8
CVE-2017-18174 [CRITICAL] CWE-416 kernel: Double free vulnerability in drivers/pinctrl/pinctrl-amd.c:amd_gpio_remove() function can lead to kernel panic
kernel: Double free vulnerability in drivers/pinctrl/pinctrl-amd.c:amd_gpio_remove() function can lead to kernel panic
In the Linux kernel before 4.7, the amd_gpio_remove function in drivers/pinctrl/pinctrl-amd.c calls the pinctrl_unregister function, leading to a double free.
Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 6 and 7, and Red Hat Enterprise MRG as they did not include the vulnerable code.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-alt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: ker
Debian
CVE-2017-18174: linux - In the Linux kernel before 4.7, the amd_gpio_remove function in drivers/pinctrl/...
vendor_debian·2017·CVSS 9.8
CVE-2017-18174 [CRITICAL] CVE-2017-18174: linux - In the Linux kernel before 4.7, the amd_gpio_remove function in drivers/pinctrl/...
In the Linux kernel before 4.7, the amd_gpio_remove function in drivers/pinctrl/pinctrl-amd.c calls the pinctrl_unregister function, leading to a double free.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-8vhr-8v52-w97w: In the Linux kernel before 4
ghsa_unreviewed·2022-05-14
CVE-2017-18174 [CRITICAL] CWE-415 GHSA-8vhr-8v52-w97w: In the Linux kernel before 4
In the Linux kernel before 4.7, the amd_gpio_remove function in drivers/pinctrl/pinctrl-amd.c calls the pinctrl_unregister function, leading to a double free.
OSV
linux-lts-xenial, linux-aws vulnerabilities
osv·2018-12-20·CVSS 9.8
CVE-2017-18174 [CRITICAL] linux-lts-xenial, linux-aws vulnerabilities
linux-lts-xenial, linux-aws vulnerabilities
USN-3848-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
It was discovered that a double free existed in the AMD GPIO driver in the
Linux kernel. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2017-18174)
It was discovered that an integer overrun vulnerability existed in the
POSIX timers implementation in the Linux kernel. A local attacker could use
this to cause a denial of service. (CVE-2018-12896)
Kanda Motohiro discovered that writing extended attributes to an XFS file
system in the Linux kernel in certain situations
OSV
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
osv·2018-12-20·CVSS 9.8
CVE-2017-18174 [CRITICAL] linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that a double free existed in the AMD GPIO driver in the
Linux kernel. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2017-18174)
It was discovered that an integer overrun vulnerability existed in the
POSIX timers implementation in the Linux kernel. A local attacker could use
this to cause a denial of service. (CVE-2018-12896)
Kanda Motohiro discovered that writing extended attributes to an XFS file
system in the Linux kernel in certain situations could cause an error
condition to occur. A local attacker could use this to cause a denial of
service. (CVE-2018-18690)
It was discovered that an integer overflow vulnerability exi
OSV
CVE-2017-18174: In the Linux kernel before 4
osv·2018-02-11·CVSS 9.8
CVE-2017-18174 [CRITICAL] CVE-2017-18174: In the Linux kernel before 4
In the Linux kernel before 4.7, the amd_gpio_remove function in drivers/pinctrl/pinctrl-amd.c calls the pinctrl_unregister function, leading to a double free.
No detection rules found.
No public exploits indexed.
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=251e22abde21833b3d29577e4d8c7aaccd650eeehttp://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8dca4a41f1ad65043a78c2338d9725f859c8d2c3https://github.com/torvalds/linux/commit/251e22abde21833b3d29577e4d8c7aaccd650eeehttps://github.com/torvalds/linux/commit/8dca4a41f1ad65043a78c2338d9725f859c8d2c3https://usn.ubuntu.com/3848-1/https://usn.ubuntu.com/3848-2/http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=251e22abde21833b3d29577e4d8c7aaccd650eeehttp://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8dca4a41f1ad65043a78c2338d9725f859c8d2c3https://github.com/torvalds/linux/commit/251e22abde21833b3d29577e4d8c7aaccd650eeehttps://github.com/torvalds/linux/commit/8dca4a41f1ad65043a78c2338d9725f859c8d2c3https://usn.ubuntu.com/3848-1/https://usn.ubuntu.com/3848-2/
2018-02-11
Published