SB2017080925 - Buffer overflow in Linux kernel
Published: August 9, 2017 Updated: August 8, 2020
Security Bulletin ID
SB2017080925
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Buffer overflow (CVE-ID: CVE-2017-12762)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
In /drivers/isdn/i4l/isdn_net.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check which can cause a buffer overflow. This affects the Linux kernel 4.9-stable tree, 4.12-stable tree, 3.18-stable tree, and 4.4-stable tree.
Remediation
Install update from vendor's website.
References
- http://www.openwall.com/lists/oss-security/2020/02/11/1
- http://www.openwall.com/lists/oss-security/2020/02/11/2
- http://www.openwall.com/lists/oss-security/2020/02/14/4
- http://www.securityfocus.com/bid/100251
- https://patchwork.kernel.org/patch/9880041/
- https://usn.ubuntu.com/3620-1/
- https://usn.ubuntu.com/3620-2/