Bug 1539725 (CVE-2017-18079) - CVE-2017-18079 kernel: Null pointer dereference in drivers/input/serio/i8042.c leading to denial-of-service
Summary: CVE-2017-18079 kernel: Null pointer dereference in drivers/input/serio/i8042....
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2017-18079
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1539728
TreeView+ depends on / blocked
 
Reported: 2018-01-29 14:06 UTC by Adam Mariš
Modified: 2021-02-17 00:53 UTC (History)
46 users (show)

Fixed In Version: kernel 4.13
Clone Of:
Environment:
Last Closed: 2018-02-12 10:26:54 UTC
Embargoed:

Attachments (Terms of Use)

Description Adam Mariš 2018-01-29 14:06:23 UTC 
A flaw was found in the Linux kernel which allowed an attacker who is able to add or remove serial devices to exploit a race condition in the serial port handling.  This would cause the system to panic or possibly have unspecified other impact because the port->exists value can change after it is validated.

Upstream patch:

https://github.com/torvalds/linux/commit/340d394a789518018f834ff70f7534fc463d3226
Comment 4 Vladis Dronov 2018-02-12 10:26:54 UTC 
Statement:

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7, its real-time kernel and Red Hat Enterprise MRG 2. At this time there are no plans to fix this issue.

This issue does not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 7 for ARM 64 and Red Hat Enterprise Linux 7 for Power 9 LE.
Note You need to log in before you can comment on or make changes to this bug.