CVE-2017-18344
published 2018-07-26CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify…
PriorityP338medium5.5CVSS 3.0
AVLACLPRLUINSUCHINAN
EXPLOIT
EPSS
3.23%
86.8th percentile
The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | linux | < linux 4.14.12-1 (bookworm) | linux 4.14.12-1 (bookworm) |
| linux | linux_kernel | < 4.14.8 | 4.14.8 |
| linux | linux_kernel | >= 0 < 4.14.12-1 | 4.14.12-1 |
| linux | linux_kernel | >= 0 < 4.14.12-1 | 4.14.12-1 |
| linux | linux_kernel | >= 0 < 4.14.12-1 | 4.14.12-1 |
| linux | linux_kernel | >= 0 < 4.14.12-1 | 4.14.12-1 |
| linux | linux_kernel | >= 0 < 3.13.0-155.205 | 3.13.0-155.205 |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | mrg_realtime | — | — |
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (Trusty HWE) regressions
vendor_ubuntu·2018-08-21·CVSS 5.5
CVE-2018-3620 [MEDIUM] Linux kernel (Trusty HWE) regressions
Title: Linux kernel (Trusty HWE) regressions
Summary: USN-3742-2 introduced regressions in the Linux Hardware Enablement
(HWE) kernel for Ubuntu 12.04 ESM.
USN-3742-2 introduced mitigations in the Linux Hardware Enablement
(HWE) kernel for Ubuntu 12.04 ESM to address L1 Terminal Fault (L1TF)
vulnerabilities (CVE-2018-3620, CVE-2018-3646). Unfortunately, the
update introduced regressions that caused kernel panics when booting
in some environments as well as preventing Java applications from
starting. This update fixes the problems.
We apologize for the inconvenience.
Original advisory details:
It was discovered that memory present in the L1 data cache of an Intel CPU
core may be exposed to a malicious process that is executing on the CPU
core. This vulnerability is also known as L1 Ter
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2018-08-14·CVSS 5.5
CVE-2017-18344 [MEDIUM] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3742-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 14.04 for Ubuntu
12.04 ESM.
It was discovered that memory present in the L1 data cache of an Intel CPU
core may be exposed to a malicious process that is executing on the CPU
core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local
attacker in a guest virtual machine could use this to expose sensitive
information (memory from other guests or the host OS). (CVE-2018-3646)
It was discovered that memory present in the L1 data cache of an Intel CPU
core may be exposed to a maliciou
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2018-08-14·CVSS 5.5
CVE-2017-18344 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that memory present in the L1 data cache of an Intel CPU
core may be exposed to a malicious process that is executing on the CPU
core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local
attacker in a guest virtual machine could use this to expose sensitive
information (memory from other guests or the host OS). (CVE-2018-3646)
It was discovered that memory present in the L1 data cache of an Intel CPU
core may be exposed to a malicious process that is executing on the CPU
core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local
attacker could use this to expose sensitive information (memory from the
kernel or other processes). (CVE-20
Red Hat
kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c
vendor_redhat·2017-12-15·CVSS 5.5
CVE-2017-18344 [MEDIUM] CWE-125 kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c
kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c
The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).
The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function.
Mitigation: Attached to this bugzilla is a systemtap script that will prevent opening
Debian
CVE-2017-18344: linux - The timer_create syscall implementation in kernel/time/posix-timers.c in the Lin...
vendor_debian·2017·CVSS 5.5
CVE-2017-18344 [MEDIUM] CVE-2017-18344: linux - The timer_create syscall implementation in kernel/time/posix-timers.c in the Lin...
The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).
Scope: local
bookworm: resolved (fixed in 4.14.12-1)
bullseye: resolved (fixed in 4.14.12-1)
forky: resolved (fixed in 4.14.12-1)
sid: resolved (fixed in 4.14.12-1)
trixie: resolved (fixed in 4.14.12-1)
GHSA
GHSA-j9fr-8f9m-c9qc: The timer_create syscall implementation in kernel/time/posix-timers
ghsa_unreviewed·2022-05-13
CVE-2017-18344 [MEDIUM] CWE-125 GHSA-j9fr-8f9m-c9qc: The timer_create syscall implementation in kernel/time/posix-timers
The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).
OSV
linux vulnerabilities
osv·2018-08-14·CVSS 5.5
CVE-2018-3646 [MEDIUM] linux vulnerabilities
linux vulnerabilities
It was discovered that memory present in the L1 data cache of an Intel CPU
core may be exposed to a malicious process that is executing on the CPU
core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local
attacker in a guest virtual machine could use this to expose sensitive
information (memory from other guests or the host OS). (CVE-2018-3646)
It was discovered that memory present in the L1 data cache of an Intel CPU
core may be exposed to a malicious process that is executing on the CPU
core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local
attacker could use this to expose sensitive information (memory from the
kernel or other processes). (CVE-2018-3620)
Andrey Konovalov discovered an out-of-bounds read in the POSIX
timers
OSV
CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers
osv·2018-07-26·CVSS 5.5
CVE-2017-18344 [MEDIUM] CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers
The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).
No detection rules found.
arXiv
KernJC: Automated Vulnerable Environment Generation for Linux Kernel Vulnerabilities
arxiv_fulltext·2024-09-24
KernJC: Automated Vulnerable Environment Generation for Linux Kernel Vulnerabilities
: Automated Vulnerable Environment Generation for Linux Kernel Vulnerabilities
Bonan Ruan
National University of Singapore
Jiahao Liu
National University of Singapore
Chuqi Zhang
National University of Singapore
Zhenkai Liang
National University of Singapore
## Abstract
Linux kernel vulnerability reproduction is a critical task in system security.
To reproduce a kernel vulnerability, the vulnerable environment and the Proof of Concept (PoC) program are needed.
Most existing research focuses on the generation of PoC, while the construction of environment is overlooked.
However, establishing an effective vulnerable environment to trigger a vulnerability is challenging.
Firstly, it is hard to guarantee that the selected kernel version for reproduction is vulnerable, as the vulner
arXiv
ECMO: Peripheral Transplantation to Rehost Embedded Linux Kernels
arxiv_fulltext·2021-10-05
ECMO: Peripheral Transplantation to Rehost Embedded Linux Kernels
: Peripheral Transplantation to Rehost Embedded Linux Kernels
[1,2]Muhui Jiang
[1]Lin Ma
[1]Yajin ZhouCorresponding author ([email protected]). *0.4em
[1]Qiang Liu
[3]Cen Zhang
[4]Zhi Wang
[2]Xiapu Luo
[1]Lei Wu
[1]Kui Ren
[1]Zhejiang University
[2]The Hong Kong Polytechnic University
[3]Nanyang Technological University
[4]Florida State University
## Abstract
Dynamic analysis based on the full-system emulator
QEMU is widely used for various purposes.
However, it is challenging to run
firmware images of embedded devices in QEMU,
especially the process to boot the Linux kernel
(we call this process rehosting the Linux kernel
in this paper).
That's because embedded devices usually use different
system-on-chips (SoCs)
from multiple vendors and only a limited
number of SoCs are currently
Bugzilla
CVE-2017-18344 kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c [fedora-all]
bugzilla·2018-08-08·CVSS 5.5
CVE-2017-18344 [MEDIUM] CVE-2017-18344 kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c [fedora-all]
CVE-2017-18344 kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue
Bugzilla
CVE-2017-18344 kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c
bugzilla·2018-08-01·CVSS 5.5
CVE-2017-18344 [MEDIUM] CVE-2017-18344 kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c
CVE-2017-18344 kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c
A flaw was found in kernel versions before 4.14.8. The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).
References:
http://seclists.org/oss-sec/2018/q3/76
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cef31d9af908243421258f1df35a4a644604efbe
Discussion:
Mitigation:
Attached to this
http://www.securityfocus.com/bid/104909http://www.securitytracker.com/id/1041414https://access.redhat.com/errata/RHSA-2018:2948https://access.redhat.com/errata/RHSA-2018:3083https://access.redhat.com/errata/RHSA-2018:3096https://access.redhat.com/errata/RHSA-2018:3459https://access.redhat.com/errata/RHSA-2018:3540https://access.redhat.com/errata/RHSA-2018:3586https://access.redhat.com/errata/RHSA-2018:3590https://access.redhat.com/errata/RHSA-2018:3591https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.8https://github.com/torvalds/linux/commit/cef31d9af908243421258f1df35a4a644604efbehttps://usn.ubuntu.com/3742-1/https://usn.ubuntu.com/3742-2/https://www.exploit-db.com/exploits/45175/http://www.securityfocus.com/bid/104909http://www.securitytracker.com/id/1041414https://access.redhat.com/errata/RHSA-2018:2948https://access.redhat.com/errata/RHSA-2018:3083https://access.redhat.com/errata/RHSA-2018:3096https://access.redhat.com/errata/RHSA-2018:3459https://access.redhat.com/errata/RHSA-2018:3540https://access.redhat.com/errata/RHSA-2018:3586https://access.redhat.com/errata/RHSA-2018:3590https://access.redhat.com/errata/RHSA-2018:3591https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.8https://github.com/torvalds/linux/commit/cef31d9af908243421258f1df35a4a644604efbehttps://usn.ubuntu.com/3742-1/https://usn.ubuntu.com/3742-2/https://www.exploit-db.com/exploits/45175/
2018-07-26
Published