CVE-2017-13695

MEDIUM5.5

The acpi_ns_evaluate() function in drivers/acpi/acpica/nseval

Published Aug 25, 2017

Modified 1 years ago

Details

The acpi_ns_evaluate() function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.

References

WEBhttp://www.securityfocus.com/bid/100497 WEBhttps://github.com/acpica/acpica/pull/296/commits/37f2c716f2c6ab14c3ba557a539c3ee3224931b5 WEBhttps://patchwork.kernel.org/patch/9850567/ADVISORYhttps://usn.ubuntu.com/3696-1/ADVISORYhttps://usn.ubuntu.com/3696-2/ADVISORYhttps://usn.ubuntu.com/3762-1/ADVISORYhttps://usn.ubuntu.com/3762-2/ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2017-13695

CVSS Analysis

CVSS v3.0

5.5

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

5.5/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Ecosystems

Timeline

PublishedAug 25, 2017

ModifiedAug 5, 2024