CVE-2017-17852

Source
Severity Medium
Remote No
Type Denial of service
Description
It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of 32-bit ALU ops.
Group Package Affected Fixed Severity Status Ticket
AVG-574 linux-hardened 4.14.7.a-1 4.14.11.a-1 High Fixed FS#56832
AVG-571 linux-zen 4.14.7-1 4.14.11-1 High Fixed FS#56832
AVG-560 linux-lts 4.9.73-1 4.9.74-1 High Not affected FS#56832
AVG-552 linux 4.14.7-1 4.14.11-1 High Fixed FS#56832
Date Advisory Group Package Severity Description
05 Jan 2018 ASA-201801-4 AVG-574 linux-hardened High multiple issues
05 Jan 2018 ASA-201801-3 AVG-571 linux-zen High multiple issues
05 Jan 2018 ASA-201801-1 AVG-552 linux High multiple issues
References
https://bugs.chromium.org/p/project-zero/issues/detail?id=1454
http://www.openwall.com/lists/oss-security/2017/12/21/2
https://git.kernel.org/linus/468f6eafa6c44cb2c5d8aad35e12f06c240a812a
Notes
Workaround by disabling unprivileged bpf:
sysctl -w kernel.unprivileged_bpf_disabled=1