UBUNTU-CVE-2017-5967

Description

The time subsystem in the Linux kernel through 4.9.9, when CONFIG_TIMER_STATS is enabled, allows local users to discover real PID values (as distinguished from PID values inside a PID namespace) by reading the /proc/timer_list file, related to the print_timer function in kernel/time/timer_list.c and the __timer_stats_timer_set_start_info function in kernel/time/timer.c.

CVSS Metrics

• v3.0•MEDIUM•Score: 4CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Systems

• ubuntu•linux

  all | < 4.4.0-208.240

• ubuntu•linux-aws

  < 4.4.0-1090.94 | < 4.4.0-1126.140

• ubuntu•linux-azure-fde

  all

• ubuntu•linux-azure-fde-5.15

  all

• ubuntu•linux-bluefield

  all

• ubuntu•linux-fips

  < 4.4.0-1060.66 | all

• ubuntu•linux-gcp

  < 4.13.0-1002.5

• ubuntu•linux-hwe

  < 4.13.0-32.35~16.04.1

• ubuntu•linux-intel-iot-realtime

  all

• ubuntu•linux-kvm

  < 4.4.0-1091.100

• ubuntu•linux-lts-xenial

  < 4.4.0-208.240~14.04.1

• ubuntu•linux-nvidia

  all

• ubuntu•linux-raspi-realtime

  all

• ubuntu•linux-raspi2

  < 4.4.0-1150.161

• ubuntu•linux-realtime

  all

• ubuntu•linux-riscv

  all

• ubuntu•linux-snapdragon

  < 4.4.0-1154.164 | < 4.15.0-1053.57

References (5)

• https://ubuntu.com/security/CVE-2017-5967
• http://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/commit/?id=dfb4357da6ddbdf57d583ba64361c9d792b0e0b1
• https://bugzilla.kernel.org/show_bug.cgi?id=193921
• https://ubuntu.com/security/notices/USN-4904-1
• https://www.cve.org/CVERecord?id=CVE-2017-5967