CVE-2017-17807 in Kernel
Zusammenfassung (Englisch)
The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current task's "default request-key keyring" via the request_key() system call, allowing a local user to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Reservieren
20.12.2017
Veröffentlichung
20.12.2017
Status
Bestätigt
Einträge
VulDB provides additional information and datapoints for this CVE:
| ID | Schwachstelle | CWE | Aus | Mas | CVE |
|---|---|---|---|---|---|
| 110933 | Linux Kernel KEYS request_key.c request_key erweiterte Rechte | 284 | Nicht definiert | Offizieller Fix | CVE-2017-17807 |