7

CVE-2017-15265

Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version < 3.2.95
Linux ≫ Linux Kernel Version >= 3.3 < 3.10.108
Linux ≫ Linux Kernel Version >= 3.11 < 3.16.50
Linux ≫ Linux Kernel Version >= 3.17 < 3.18.76
Linux ≫ Linux Kernel Version >= 3.19 < 4.1.46
Linux ≫ Linux Kernel Version >= 4.2 < 4.4.93
Linux ≫ Linux Kernel Version >= 4.5 < 4.9.57
Linux ≫ Linux Kernel Version >= 4.10 < 4.13.8
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.38% 0.293
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7 1 5.9
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.9 3.4 10
AV:L/AC:M/Au:N/C:C/I:C/A:C
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0676
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1062
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html
Third Party Advisory
Mailing List
https://access.redhat.com/errata/RHSA-2018:3822
Third Party Advisory
https://source.android.com/security/bulletin/2018-02-01
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1130
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1170
Third Party Advisory
https://usn.ubuntu.com/3698-1/
Third Party Advisory
https://usn.ubuntu.com/3698-2/
Third Party Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=71105998845fb012937332fe2e806d443c09e026
Patch
Vendor Advisory
Issue Tracking
http://mailman.alsa-project.org/pipermail/alsa-devel/2017-October/126292.html
Patch
Third Party Advisory
Mailing List
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.8
Vendor Advisory
Release Notes
http://www.openwall.com/lists/oss-security/2017/10/11/3
Patch
Third Party Advisory
Mailing List
http://www.securityfocus.com/bid/101288
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039561
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:2390
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3823
Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1062520
Patch
Third Party Advisory
Issue Tracking
https://github.com/torvalds/linux/commit/71105998845fb012937332fe2e806d443c09e026
Patch
Third Party Advisory
Issue Tracking