NVD Vulnerability Detail

CVE-2017-7187

Summary	The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function.
Publication Date	March 20, 2017, 11:59 p.m.
Registration Date	Jan. 26, 2021, 1:28 p.m.
Last Update	Nov. 21, 2024, 12:31 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/96989	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/96989	Third Party Advisory VDB Entry
3	http://www.securitytracker.com/id/1038086	Third Party Advisory VDB Entry
4	http://www.securitytracker.com/id/1038086	Third Party Advisory VDB Entry
5	https://access.redhat.com/errata/RHSA-2017:1842	Third Party Advisory
6	https://access.redhat.com/errata/RHSA-2017:1842	Third Party Advisory
7	https://access.redhat.com/errata/RHSA-2017:2077	Third Party Advisory
8	https://access.redhat.com/errata/RHSA-2017:2077	Third Party Advisory
9	https://access.redhat.com/errata/RHSA-2017:2669	Third Party Advisory
10	https://access.redhat.com/errata/RHSA-2017:2669	Third Party Advisory
11	https://gist.github.com/dvyukov/48ad14e84de45b0be92b7f0eda20ff1b	Third Party Advisory
12	https://gist.github.com/dvyukov/48ad14e84de45b0be92b7f0eda20ff1b	Third Party Advisory
13	https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git/commit/?h=4.11/scsi-fixes&id=bf33f87dd04c371ea33feb821b60d63d754e3124	Issue Tracking Patch Vendor Advisory
14	https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git/commit/?h=4.11/scsi-fixes&id=bf33f87dd04c371ea33feb821b60d63d754e3124	Issue Tracking Patch Vendor Advisory
15	https://source.android.com/security/bulletin/pixel/2017-10-01	Third Party Advisory
16	https://source.android.com/security/bulletin/pixel/2017-10-01	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

JVN Vulnerability Information

Linux Kernel の drivers/scsi/sg.c の sg_ioctl 関数におけるサービス運用妨害 (DoS) の脆弱性

Title	Linux Kernel の drivers/scsi/sg.c の sg_ioctl 関数におけるサービス運用妨害 (DoS) の脆弱性
Summary	Linux Kernel の drivers/scsi/sg.c の sg_ioct 関数には、サービス運用妨害 (スタックベースのバッファオーバーフロー) 状態にされる、または不特定の影響を受ける脆弱性が存在します。
Possible impacts	ローカルユーザにより、SG_NEXT_CMD_LEN ioctl call の過度に大きなコマンドサイズを介して、 sg_write 関数での境界外書き込みアクセスを引き起こされることで、サービス運用妨害 (スタックベースのバッファオーバーフロー) 状態にされる、または不特定の影響を受ける可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	March 16, 2017, midnight
Registration Date	April 19, 2017, 2:09 p.m.
Last Update	April 19, 2017, 2:09 p.m.

Affected System

Linux

Linux Kernel 4.10.4 まで

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-7187	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7187
National Vulnerability Database (NVD)
2	CVE-2017-7187	https://nvd.nist.gov/vuln/detail/CVE-2017-7187

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
GitHub
1	gist:48ad14e84de45b0be92b7f0eda20ff1b	https://gist.github.com/dvyukov/48ad14e84de45b0be92b7f0eda20ff1b
Linux Kernel
2	Linux Kernel Archives	http://www.kernel.org
Linux kernel source tree
3	scsi: sg: check length passed to SG_NEXT_CMD_LEN	https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git/commit/?h=4.11/scsi-fixes&id=bf33f87dd04c371ea33feb821b60d63d754e3124

Change Log

No	Changed Details	Date of change
0	[2017年04月19日] 掲載	Feb. 17, 2018, 10:37 a.m.