CVE-2017-14140

Published: Sep 5, 2017Modified: May 13, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The move_pages system call in mm/migrate.c in the Linux kernel before 4.12.9 doesn't check the effective uid of the target process, enabling a local attacker to learn the memory layout of a setuid executable despite ASLR.

Affected (1)

Products: Linux: Linux Kernel

Linux

1 product

Linux Kernel

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Up to 4.12.8

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (20)

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=197e7e521384a23b9e585178f3f11c9fa08274b9

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

http://www.debian.org/security/2017/dsa-3981

Source: cve@mitre.org

http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.9

Source: cve@mitre.org

Release NotesVendor Advisory

http://www.securityfocus.com/bid/100876

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2018:0676

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2018:1062

Source: cve@mitre.org

https://github.com/torvalds/linux/commit/197e7e521384a23b9e585178f3f11c9fa08274b9

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://source.android.com/security/bulletin/pixel/2018-01-01

Source: cve@mitre.org

https://usn.ubuntu.com/3583-1/

Source: cve@mitre.org

https://usn.ubuntu.com/3583-2/

Source: cve@mitre.org

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=197e7e521384a23b9e585178f3f11c9fa08274b9