Home CVE Database CVE-2017-7482

CVE-2017-7482

Description

When a kerberos 5 ticket is being decoded so that it can be loaded into an rxrpc-type key, the length of a variable-length field is checked to make sure that it\'s not going to overrun the allocated buffer space. The data is padded to the nearest four-byte boundary and the code doesn\'t check for this extra four-byte aligned padding. This can lead to the size-remaining variable wrapping and the data pointer accessing or reading past the end of the buffer. The read functionality could allow for a 3 byte infoleak and the write flaw could allow for an uncontrolled 3 byte write to kernels slab memory. This could lead to memory corruption and possible privilege escalation although no known exploit exists at the time of writing.

Priority: HIGH
CVSS v3: 7.8
Publish Date: Jun 21, 2018
Related ID: --
CVSS v2: HIGH
Modified Date: Jun 21, 2018

Find out more about CVE-2017-7482 from the MITRE-CVE dictionary and NIST NVD


Products Affected

Login may be required to access defects or downloads.

Product Name Status Defect Fixed Downloads
Linux
Wind River Linux LTS 17 Not Vulnerable -- -- --
Wind River Linux 9 Fixed LIN9-7021
9.0.0.17 Wind River Linux 9.0.0.17
Wind River Linux 9.0.0.18
Wind River Linux 9.0.0.19
Wind River Linux 9.0.0.20
Wind River Linux 9.0.0.21
Wind River Linux 9.0.0.22
Wind River Linux 9.0.0.23
Wind River Linux 9.0.0.24
Wind River Linux 9.0.0.25
Wind River Linux 8 Fixed LIN8-9340
8.0.0.27 Wind River Linux 8.0.0.27
Wind River Linux 8.0.0.28
Wind River Linux 8.0.0.29
Wind River Linux 8.0.0.30
Wind River Linux 8.0.0.31
Wind River Linux 8.0.0.32
Wind River Linux 8.0.0.33
Wind River Linux LTS 18 Not Vulnerable -- -- --
Wind River Linux LTS 19 Not Vulnerable -- -- --
Wind River Linux CD release Not Vulnerable -- -- --
VxWorks
VxWorks 7 Not Vulnerable -- -- --
VxWorks 6.9 Not Vulnerable -- -- --

Related Products

Product Name Status Defect Fixed Downloads
Linux 7 SCP Not Vulnerable -- -- --
Linux 7 CGP Not Vulnerable -- -- --

Comments

linux

Live chat
Online