CVE-2017-7294

High

Published: 29/03/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The vmw_surface_define_ioctl function in the Linux kernel up to version 4.10.6 does not validate the addition of certain levels data, allowing local users to trigger an integer overflow and out-of-bounds write. This can lead to system hang or crash, and potentially privilege escalation.

Risk Assessment

This vulnerability poses a risk of system failure and the potential for local users to escalate privileges, which can lead to serious security implications for the organization.

Recommendation

It is recommended to update the Linux kernel to version 4.10.7 or later to mitigate this vulnerability and implement additional security measures for local users.

Other vulnerabilities in Linux kernel (do wersji 4.10.6)

CVE-2017-7184High
The xfrm_replay_verify_len function in the Linux kernel through version 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, allowing local users to obtain root privileges or cause a denial of service through heap-based out-of-bounds access.

Original NVD description (English source)

The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.6 does not validate addition of certain levels data, which allows local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device.