CVE-2017-5548
HighSummary
In the Linux kernel version 4.9.x before 4.9.6, there is a bug in atusb.c that incorrectly interacts with the CONFIG_VMAP_STACK option. This allows local users to cause a denial of service (system crash or memory corruption) by leveraging the use of more than one virtual page for a DMA scatterlist.
Risk Assessment
This vulnerability can lead to system crashes or memory corruption, impacting the availability of services within the organization. There is also a risk of unspecified other impacts on the system.
Recommendation
It is recommended to update the Linux kernel to version 4.9.6 or later to mitigate this vulnerability. Additionally, monitor systems for unauthorized access by local users.
Other vulnerabilities in Linux kernel 4.9.x before 4.9.6
See all- CVE-2017-8072High
The cp2112_gpio_direction_input function in the Linux kernel 4.9.x before 4.9.9 does not return the expected EIO error status for a zero-length report, which may lead to an unspecified impact on local users.
- CVE-2017-8070High
In the Linux kernel 4.9.x before version 4.9.11, there is a bug in drivers/net/usb/catc.c that incorrectly interacts with the CONFIG_VMAP_STACK option. This allows local users to cause a denial of service or memory corruption.
- CVE-2017-8069High
In the Linux kernel 4.9.x before version 4.9.11, there is a bug in drivers/net/usb/rtl8150.c that incorrectly interacts with the CONFIG_VMAP_STACK option. This allows local users to cause a denial of service or memory corruption.
- CVE-2017-8068High
In the Linux kernel 4.9.x before 4.9.11, there is a bug in drivers/net/usb/pegasus.c that incorrectly interacts with the CONFIG_VMAP_STACK option. This allows local users to cause a denial of service or memory corruption.
- CVE-2017-5547High
In the Linux kernel 4.9.x before version 4.9.6, there is a bug in drivers/hid/hid-corsair.c that interacts incorrectly with the CONFIG_VMAP_STACK option. This allows local users to cause a denial of service or memory corruption.
- CVE-2016-10153High
The crypto scatterlist API in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, potentially leading to system crashes or memory corruption by local users.
Original NVD description (English source)
drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.