Vulnetix
Try Vulnetix Request Demo
CVE-2017-18344 PUBLISHED

The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).

EPSS 11.90% · 93.7th percentile

Risk Scores

EPSS Score
11.90%
93.7th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSlinux-hwe4.8.0-39.42~16.04.1, 4.8.0-41.44~16.04.1, 4.8.0-42.45~16.04.1
Ubuntu:20.04:LTSlinux-azure-fde5.4.0-1089.94+cvm1.2, 5.4.0-1103.109+cvm1.1, 5.4.0-1100.106+cvm1.1
Ubuntu:22.04:LTSlinux-riscv5.15.0-1027.31, 5.13.0-1004.4, 5.13.0-1006.6+22.04.1
Ubuntu:22.04:LTSlinux-realtime0, 5.15.0-1032.35
Ubuntu:20.04:LTSlinux-raspi25.3.0-1014.16, 5.3.0-1015.17, 0
Ubuntu:16.04:LTSlinux-kvm4.4.0-1019.24, 4.4.0-1015.20, 4.4.0-1017.22
Ubuntu:14.04:LTSlinux3.13.0-110.157, 3.13.0-111.158, 3.13.0-112.159
Ubuntu:16.04:LTSlinux-azure4.11.0-1015.15, 0, 4.11.0-1009.9
Ubuntu:16.04:LTSlinux-aws4.4.0-1054.63, 0, 4.4.0-1039.48
Ubuntu:16.04:LTSlinux-gcp4.13.0-1017.21, 4.13.0-1019.23, 0
Ubuntu:14.04:LTSlinux-lts-xenial4.4.0-53.74~14.04.1, 4.4.0-57.78~14.04.1, 4.4.0-59.80~14.04.1
Ubuntu:24.04:LTSlinux-raspi-realtime6.8.0-2019.20, 0
Ubuntu:22.04:LTSlinux-intel-iot-realtime5.15.0-1073.75, 0
Ubuntu:Pro:FIPS:16.04:LTSlinux-fips4.4.0-1006.6, 0, 4.4.0-1003.3
Ubuntu:16.04:LTSlinux4.4.0-62.83, 4.4.0-97.120, 4.4.0-98.121
Ubuntu:20.04:LTSlinux-gke5.4.0-1051.54, 5.4.0-1049.52, 5.4.0-1046.48
Ubuntu:20.04:LTSlinux-riscv5.4.0-28.32, 0, 5.4.0-24.28
Ubuntu:16.04:LTSlinux-raspi24.4.0-1080.88, 4.4.0-1010.12, 4.4.0-1009.10
Ubuntu:16.04:LTSlinux-euclid4.4.0-9019.20, 4.4.0-9020.21, 4.4.0-9021.22
Ubuntu:16.04:LTSlinux-snapdragon0, 4.4.0-1013.14, 4.4.0-1013.15

…and 1 more

Timeline

References

Open in Interactive Console →