kernel: ACPI operand cache leak in nseval.c
Published Aug 25, 2017
5.5
MEDIUMCVSS 3.0
EPSS 0.44%
Description
The acpi_ns_evaluate() function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.
Affected products
No data.
- ≤ 4.12.9
No data.
Red Hat Enterprise Linux 5
kernel
Will not fix
Red Hat Enterprise Linux 6
kernel
Will not fix
Red Hat Enterprise Linux 7
acpica-tools
Will not fix
Red Hat Enterprise Linux 7
kernel
Will not fix
Red Hat Enterprise Linux 7
kernel-alt
Affected
Red Hat Enterprise Linux 7
kernel-rt
Will not fix
Red Hat Enterprise MRG 2
realtime-kernel
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 5 | kernel | Will not fix | n/a |
| Red Hat Enterprise Linux 6 | kernel | Will not fix | n/a |
| Red Hat Enterprise Linux 7 | acpica-tools | Will not fix | n/a |
| Red Hat Enterprise Linux 7 | kernel | Will not fix | n/a |
| Red Hat Enterprise Linux 7 | kernel-alt | Affected | n/a |
| Red Hat Enterprise Linux 7 | kernel-rt | Will not fix | n/a |
| Red Hat Enterprise MRG 2 | realtime-kernel | Will not fix | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/ The Red Hat Security Response Team has rated this issue as having moderate security impact. The risks associated with fixing this bug are greater than the moderate severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 5,6,7 and Red Hat Enterprise MRG.
References (12)
- http://www.securityfocus.com/bid/100497 vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
- https://access.redhat.com/security/cve/CVE-2017-13695 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1485349 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-5212 Advisory
- https://github.com/acpica/acpica/pull/296/commits/37f2c716f2c6ab14c3ba557a539c3ee3224931b5 x_refsource_MISCIssue TrackingPatchThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2017-13695
- https://patchwork.kernel.org/patch/9850567/ x_refsource_MISCPatchThird Party Advisory
- https://usn.ubuntu.com/3696-1/ vendor-advisoryx_refsource_UBUNTU
- https://usn.ubuntu.com/3696-2/ vendor-advisoryx_refsource_UBUNTU
- https://usn.ubuntu.com/3762-1/ vendor-advisoryx_refsource_UBUNTU
- https://usn.ubuntu.com/3762-2/ vendor-advisoryx_refsource_UBUNTU
- https://www.cve.org/CVERecord?id=CVE-2017-13695
| Link | Providers | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/100497 | vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry | |
| https://access.redhat.com/security/cve/CVE-2017-13695 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1485349 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-5212 | Advisory | |
| https://github.com/acpica/acpica/pull/296/commits/37f2c716f2c6ab14c3ba557a539c3ee3224931b5 | x_refsource_MISCIssue TrackingPatchThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2017-13695 | ||
| https://patchwork.kernel.org/patch/9850567/ | x_refsource_MISCPatchThird Party Advisory | |
| https://usn.ubuntu.com/3696-1/ | vendor-advisoryx_refsource_UBUNTU | |
| https://usn.ubuntu.com/3696-2/ | vendor-advisoryx_refsource_UBUNTU | |
| https://usn.ubuntu.com/3762-1/ | vendor-advisoryx_refsource_UBUNTU | |
| https://usn.ubuntu.com/3762-2/ | vendor-advisoryx_refsource_UBUNTU | |
| https://www.cve.org/CVERecord?id=CVE-2017-13695 |
Change history (0)
No recorded changes yet.