huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2016-9806: kernel: netlink: double-free in netlink_dump
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-05-15T00:00:00+00:00

A double free vulnerability was found in netlink_dump, which could cause a denial of service or possibly other unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 as the code with the flaw is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.7
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 92964c79b357efd980812c4de5c1fd2ec8bb5520
CVE-2016-9807: gstreamer-plugins-good: Invalid memory read in flx_decode_chunks
Component: gstreamer-plugins-good
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2016-11-22T00:00:00+00:00

An invalid memory read access flaw was found in GStreamer's FLC/FLI/FLX media file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash.


Affected upstream versions: n/a
Fixed upstream versions: 1.11.1
Upstream repository: https://cgit.freedesktop.org/gstreamer/gst-plugins-good
Upstream fix commit: 153a8ae752c90d07190ef45803422a4f71ea8bff
CVE-2016-9840: zlib: Out-of-bound pointer arithmetic in inftrees.c
Component: zlib
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-09-22T00:00:00+00:00

A vulnerability was discovered in the inftrees.c file of zlib. Pointer arithmetic operations violate the C standard by subtracting an offset from an array pointer before its allocated memory, leading to undefined behavior.

Statement: While this undefined behavior does not currently manifest as an exploitable issue on Red Hat Enterprise Linux systems using GCC compilers, it could become problematic with future compiler implementations. This flaw affects various Java packages in Red Hat Enterprise Linux 6 and 7, but native zlib packages in Red Hat Enterprise Linux are not impacted due to the specific compiler implementation used.

Affected upstream versions: n/a
Fixed upstream versions: v1.2.9
Upstream repository: https://github.com/madler/zlib
Upstream fix commit: 6a043145ca6e9c55184013841a67b2fef87e44c0
CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c
Component: zlib
Severity: Low
CVSS v3: 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-09-22T00:00:00+00:00

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.


Affected upstream versions: n/a
Fixed upstream versions: v1.2.9
Upstream repository: https://github.com/madler/zlib
Upstream fix commit: 9aaec95e82117c1cb0f9624264c3618fc380cecb
CVE-2016-9842: zlib: Undefined left shift of negative number
Component: zlib
Severity: Low
CVSS v3: 8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-09-06T00:00:00+00:00

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.


Affected upstream versions: n/a
Fixed upstream versions: v1.2.9
Upstream repository: https://github.com/madler/zlib
Upstream fix commit: e54e1299404101a5a9d0cf5e45512b543967f958
CVE-2016-9843: zlib: Big-endian out-of-bounds pointer
Component: zlib
Severity: Low
CVSS v3: 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-09-29T00:00:00+00:00

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.


Affected upstream versions: n/a
Fixed upstream versions: v1.2.9
Upstream repository: https://github.com/madler/zlib
Upstream fix commit: d1d577490c15a0c6862473d7576352a9f18ef811
CVE-2016-9922: Qemu: display: cirrus_vga: a divide by zero in cirrus_do_copy
Component: Qemu
Severity: Low
CWE: CWE-369 (Divide By Zero)
CVSS v3: 3 (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L)
Public date: 2016-10-18T00:00:00+00:00

The cirrus_do_copy function in hw/display/cirrus_vga.c in QEMU (aka Quick Emulator), when cirrus graphics mode is VGA, allows local guest OS privileged users to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving blit pitch values.


Affected upstream versions: n/a
Fixed upstream versions: v2.8.0
Upstream repository: https://git.qemu-project.org/qemu.git
Upstream fix commit: 4299b90e9ba9ce5ca9024572804ba751aa1a7e70
CVE-2016-9933: gd: Stack overflow in gdImageFillToBorder on truecolor images
Component: gd
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2016-12-08T00:00:00+00:00

An infinite recursion flaw was found in the gdImageFillToBorder() function from the gd library; also used by PHP imagefilltoborder() function, when passing a negative integer as the color parameter, triggering a stack overflow. A remote attacker with ability to force a negative color identifier when calling the function could crash the PHP application, causing a Denial of Service.

Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: php-5.6.29
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 863d37ea66d5c960db08d6f4a2cbd2518f0f80d1
CVE-2016-9934: php: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow
Component: php
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2015-12-08T00:00:00+00:00

ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before 7.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted serialized data in a wddxPacket XML document, as demonstrated by a PDORow string.


Affected upstream versions: n/a
Fixed upstream versions: php-5.6.29
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 6045de69c7dedcba3eadf7c4bba424b19c81d00d
CVE-2016-9935: php: Invalid read when wddx decodes empty boolean element
Component: php
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.2 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L)
Public date: 2016-12-08T00:00:00+00:00

The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document.


Affected upstream versions: n/a
Fixed upstream versions: php-5.6.29
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 66fd44209d5ffcb9b3d1bc1b9fd8e35b485040c0
CVE-2016-9936: php: Use After Free in unserialize()
Component: php
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-12-08T00:00:00+00:00

The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6834.


Affected upstream versions: n/a
Fixed upstream versions: php-7.0.14
Upstream repository: https://github.com/php/php-src
Upstream fix commit: b2af4e8868726a040234de113436c6e4f6372d17
CVE-2016-9962: docker: insecure opening of file-descriptor allows privilege escalation
Component: docker
Severity: Important
CVSS v3: 7.5 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
Public date: 2017-01-11T00:00:00+00:00

The runc component used by `docker exec` feature of docker allowed additional container processes to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain low-level access to these new processes during initialization. An attacker can, depending on the nature of the incoming process, leverage this to elevate access to the host. This ranges from accessing host content through the file descriptors of the incoming process to, potentially, a complete container escape by leveraging memory access or syscall interception.


Affected upstream versions: n/a
Upstream repository: https://github.com/opencontainers/runc
Upstream fix commit: 50a19c6ff828c58e5dab13830bd3dacde268afe5
CVE-2017-0553: libnl: Integer overflow in nlmsg_reserve()
Component: libnl
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2017-02-07T00:00:00+00:00

An integer overflow leading to a heap-buffer overflow was found in the libnl library. An attacker could use this flaw to cause an application compiled with libnl to crash or possibly execute arbitrary code in the context of the user running such an application.


Affected upstream versions: Android-5.0.2, Android-5.1.1, Android-6.0, Android-6.0.1, Android-7.0, Android-7.1.1
Upstream repository: https://git.infradead.org/users/tgr/libnl.git
Upstream fix commit: 3e18948f17148e6a3c4255bdeaaf01ef6081ceeb
CVE-2017-0861: kernel: Use-after-free in snd_pcm_info function in ALSA subsystem potentially leads to privilege escalation
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2017-12-05T00:00:00+00:00

Use-after-free vulnerability in the snd_pcm_info() function in the ALSA subsystem in the Linux kernel allows attackers to induce a kernel memory corruption and possibly crash or lock up a system. Due to the nature of the flaw, a privilege escalation cannot be fully ruled out, although we believe it is unlikely.


Affected upstream versions: Android kernel
Fixed upstream versions: v4.15
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 362bca57f5d78220f8b5907b875961af9436e229
CVE-2017-0899: rubygems: Escape sequence in the "summary" field of gemspec
Component: rubygems
Severity: Low
CWE: CWE-138 (Improper Neutralization of Special Elements)
CVSS v3: 4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Public date: 2017-08-31T00:00:00+00:00

A vulnerability was found where rubygems did not properly sanitize gems' specification text. A specially crafted gem could interact with the terminal via the use of escape sequences.

Statement: This issue affects the versions of ruby as shipped with Red Hat Enterprise Linux 6, and 7 and the versions of rh-ruby22-ruby and rh-ruby23-ruby as shipped with Red Hat Software Collections. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: Versions before 2.6.13
Fixed upstream versions: bundler-v2.2.0
Upstream repository: https://github.com/rubygems/rubygems
Upstream fix commit: 1bcbc7fe637b03145401ec9c094066285934a7f1
CVE-2017-0900: rubygems: No size limit in summary length of gem spec
Component: rubygems
Severity: Low
CWE: CWE-138 (Improper Neutralization of Special Elements)
CVSS v3: 4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2017-09-01T00:00:00+00:00

It was found that rubygems could use an excessive amount of CPU while parsing a sufficiently long gem summary. A specially crafted gem from a gem repository could freeze gem commands attempting to parse its summary.

Statement: This issue affects the versions of ruby as shipped with Red Hat Enterprise Linux 6, and 7 and the versions of rh-ruby22-ruby and rh-ruby23-ruby as shipped with Red Hat Software Collections. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: bundler-v2.2.0
Upstream repository: https://github.com/rubygems/rubygems
Upstream fix commit: 8a38a4fc24c6591e6c8f43d1fadab6efeb4d6251
CVE-2017-0901: rubygems: Arbitrary file overwrite due to incorrect validation of specification name
Component: rubygems
Severity: Moderate
CWE: CWE-138 (Improper Neutralization of Special Elements)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Public date: 2017-09-01T00:00:00+00:00

It was found that rubygems did not sanitize gem names during installation of a given gem. A specially crafted gem could use this flaw to install files outside of the regular directory.

Statement: This issue affects the versions of ruby as shipped with Red Hat Enterprise Linux 6, and 7 and the versions of rh-ruby22-ruby and rh-ruby23-ruby as shipped with Red Hat Software Collections. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: Versions before 2.6.13
Fixed upstream versions: bundler-v2.2.0
Upstream repository: https://github.com/rubygems/rubygems
Upstream fix commit: ad5c0a53a86ca5b218c7976765c0365b91d22cb2
CVE-2017-0902: rubygems: DNS hijacking vulnerability
Component: rubygems
Severity: Moderate
CWE: CWE-138 (Improper Neutralization of Special Elements)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2017-08-31T00:00:00+00:00

A vulnerability was found where rubygems did not sanitize DNS responses when requesting the hostname of the rubygems server for a domain, via a _rubygems._tcp DNS SRV query. An attacker with the ability to manipulate DNS responses could direct the gem command towards a different domain.

Statement: This issue affects the versions of ruby as shipped with Red Hat Enterprise Linux 6, and 7 and the versions of rh-ruby22-ruby and rh-ruby23-ruby as shipped with Red Hat Software Collections. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: Versions before 2.6.13
Fixed upstream versions: bundler-v2.2.0
Upstream repository: https://github.com/rubygems/rubygems
Upstream fix commit: 8d91516fb7037ecfb27622f605dc40245e0f8d32
CVE-2017-0903: rubygems: Unsafe object deserialization through YAML formatted gem specifications
Component: rubygems
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.6 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2017-10-10T00:00:00+00:00

A vulnerability was found where the rubygems module was vulnerable to an unsafe YAML deserialization when inspecting a gem. Applications inspecting gem files without installing them can be tricked to execute arbitrary code in the context of the ruby interpreter.

Statement: This issue did not affect the versions of rubygems as shipped with Red Hat Enterprise Linux 6.

This issue affects the versions of ruby as shipped with Red Hat Enterprise Linux 7 and the versions of rh-ruby22-ruby and rh-ruby23-ruby as shipped with Red Hat Software Collections. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: Versions >= 2.0.0
Fixed upstream versions: bundler-v2.2.0
Upstream repository: https://github.com/rubygems/rubygems
Upstream fix commit: 510b1638ac9bba3ceb7a5d73135dafff9e5bab49
CVE-2017-1000083: evince: command injection via filename in tar-compressed comics archive
Component: evince
Severity: Important
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
CVSS v3: 7.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)
Public date: 2017-07-13T00:00:00+00:00

It was found that evince did not properly sanitize the command line which is run to untar Comic Book Tar (CBT) files, thereby allowing command injection. A specially crafted CBT file, when opened by evince or evince-thumbnailer, could execute arbitrary commands in the context of the evince program.


Affected upstream versions: n/a
Fixed upstream versions: 3.24.1
Upstream repository: https://github.com/GNOME/evince
Upstream fix commit: 717df38fd8509bf883b70d680c9b1b3cf36732ee
CVE-2017-1000198: tcmu-runner: glfs handler allows local DoS via crafted CheckConfig strings
Component: tcmu-runner
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-05-21T00:00:00+00:00

A flaw was found in the implementation of CheckConfig method in handler_glfs.so of the tcmu-runner daemon. A local, non-root user with access to the D-Bus system bus could send a specially crafted string to CheckConfig method resulting in various kinds of segmentation fault.


Affected upstream versions: n/a
Fixed upstream versions: v1.3.0
Upstream repository: https://github.com/open-iscsi/tcmu-runner
Upstream fix commit: 61bd03e600d2abf309173e9186f4d465bb1b7157
CVE-2017-1000200: tcmu-runner: UnregisterHandler D-Bus method in tcmu-runner daemon for internal handler causes DoS
Component: tcmu-runner
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-07-14T00:00:00+00:00

A NULL pointer dereference flaw was found in the UnregisterHandler method implemented in the tcmu-runner daemon. A local, non-root user with access to the D-Bus system bus could call the UnregisterHandler method with the name of a handler loaded internally in tcmu-runner via dlopen() to trigger DoS.


Affected upstream versions: n/a
Fixed upstream versions: v1.3.0
Upstream repository: https://github.com/open-iscsi/tcmu-runner
Upstream fix commit: bb80e9c7a798f035768260ebdadffb6eb0786178
CVE-2017-1000201: tcmu-runner: UnregisterHandler dbus method in tcmu-runner daemon for non-existing handler causes DoS
Component: tcmu-runner
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-07-14T00:00:00+00:00

A NULL pointer dereference flaw was found in the UnregisterHandler method implemented in the tcmu-runner daemon. A local, non-root user with access to the D-Bus system bus could call UnregisterHandler method with non-existing tcmu handler as paramater to trigger DoS.


Affected upstream versions: n/a
Fixed upstream versions: v1.3.0
Upstream repository: https://github.com/open-iscsi/tcmu-runner
Upstream fix commit: e2d953050766ac538615a811c64b34358614edce
CVE-2017-1000251: kernel: stack buffer overflow in the native Bluetooth stack
Component: kernel
Severity: Important
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 7.5 (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2017-09-12T00:00:00+00:00

A stack buffer overflow flaw was found in the way the Bluetooth subsystem of the Linux kernel processed pending L2CAP configuration responses from a client. On systems with the stack protection feature enabled in the kernel (CONFIG_CC_STACKPROTECTOR=y, which is enabled on all architectures other than s390x and ppc64[le]), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to crash the system. Due to the nature of the stack protection feature, code execution cannot be fully ruled out, although we believe it is unlikely. On systems without the stack protection feature (ppc64[le]; the Bluetooth modules are not built on s390x), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to remotely execute arbitrary code on the system with ring 0 (kernel) privileges.

Statement: This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5.

This issue affects the version of the kernel packages as shipped with Red Hat Enterprise Linux 6 and 7, and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise MRG 2 will address this issue.

For further information please refer to the vulnerability article in the Customer Portal: https://access.redhat.com/security/vulnerabilities/blueborne

Affected upstream versions: n/a
Fixed upstream versions: v2.6.32
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: f2fcfcd670257236ebf2088bbdf26f6a8ef459fe
CVE-2017-1000252: kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ
Component: kernel
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.4 (CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H)
Public date: 2017-09-15T00:00:00+00:00

A reachable assertion failure flaw was found in the Linux kernel built with KVM virtualisation(CONFIG_KVM) support with Virtual Function I/O feature (CONFIG_VFIO) enabled. This failure could occur if a malicious guest device sent a virtual interrupt (guest IRQ) with a larger (>1024) index value.

Statement: This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 7. Future kernel updates for Red Hat Enterprise Linux 7 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.14
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 36ae3c0a36b7456432fedce38ae2f7bd3e01a563
CVE-2017-1000380: kernel: information leak due to a data race in ALSA timer
Component: kernel
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2017-06-12T00:00:00+00:00

It was found that the timer functionality in the Linux kernel ALSA subsystem is prone to a race condition between read and ioctl system call handlers, resulting in an uninitialized memory disclosure to user space. A local user could use this flaw to read information belonging to other users.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates of this product due to its life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.12
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: ba3021b2c79b2fa9114f92790a99deb27a65b728