CVE-2017-14156

MEDIUM5.5

The atyfb_ioctl function in drivers/video/fbdev/aty/atyfb_base

Published Sep 5, 2017

Modified 1 years ago

Details

The atyfb_ioctl function in drivers/video/fbdev/aty/atyfb_base.c in the Linux kernel through 4.12.10 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory by reading locations associated with padding bytes.

References

ADVISORYhttp://www.debian.org/security/2017/dsa-3981 WEBhttp://www.securityfocus.com/bid/100634 WEBhttps://github.com/torvalds/linux/pull/441 WEBhttps://marc.info/?l=linux-kernel&m=150401461613306&w=2 WEBhttps://marc.info/?l=linux-kernel&m=150453196710422&w=2 ADVISORYhttps://usn.ubuntu.com/3583-1/ADVISORYhttps://usn.ubuntu.com/3583-2/ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2017-14156

CVSS Analysis

CVSS v3.0

5.5

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

5.5/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Ecosystems

Timeline

PublishedSep 5, 2017

ModifiedAug 5, 2024

CVE-2017-14156 | Mondoo Vulnerability Intelligence