| Revision Date: | 2017-02-06 | Version: | 1 | | Title: | CVE-2017-5550 on Ubuntu 16.04 LTS (xenial) - medium. | | Description: | Off-by-one error in the pipe_advance function in lib/iov_iter.c in the Linux kernel before 4.9.5 allows local users to obtain sensitive information from uninitialized heap-memory locations in opportunistic circumstances by reading from a pipe after an incorrect buffer-release decision. It was discovered that a fencepost error existed in the pipe_advance() function in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory).
| | Family: | unix | Class: | vulnerability | | Status: | | Reference(s): | CVE-2017-5550
| | Platform(s): | Ubuntu 16.04 LTS
| Product(s): | | | Definition Synopsis | | Ubuntu 16.04 LTS (xenial) is installed. AND Package Information
linux-azure package in xenial, is related to the CVE in some way and has been fixed (note: '4.11.0-1009.9').
OR linux-euclid: while related to the CVE in some way, a decision has been made to ignore this issue (note: 'was needed ESM criteria').
OR linux-flo: while related to the CVE in some way, a decision has been made to ignore this issue (note: 'abandoned').
OR linux-gcp package in xenial, is related to the CVE in some way and has been fixed (note: '4.10.0-1004.4').
OR linux-gke: while related to the CVE in some way, a decision has been made to ignore this issue (note: 'was needed now end-of-life').
OR linux-goldfish: while related to the CVE in some way, a decision has been made to ignore this issue (note: 'abandoned').
OR linux-hwe package in xenial, is related to the CVE in some way and has been fixed (note: '4.10.0-27.30~16.04.2').
OR linux-mako: while related to the CVE in some way, a decision has been made to ignore this issue (note: 'abandoned').
OR linux-meta-azure package in xenial, is related to the CVE in some way and has been fixed (note: '4.11.0-1009.9').
OR linux-meta-gcp package in xenial, is related to the CVE in some way and has been fixed (note: '4.10.0-1004.4').
OR linux-meta-hwe package in xenial, is related to the CVE in some way and has been fixed (note: '4.10.0-27.30~16.04.2').
OR linux-oem package in xenial, is related to the CVE in some way and has been fixed (note: '4.13.0-1008.9').
OR linux-signed-azure package in xenial, is related to the CVE in some way and has been fixed (note: '4.11.0-1009.9').
OR linux-signed-gcp package in xenial, is related to the CVE in some way and has been fixed (note: '4.10.0-1004.4').
OR linux-signed-hwe package in xenial, is related to the CVE in some way and has been fixed (note: '4.10.0-27.30~16.04.2').
|
|