{"id":"CVE-2017-18221","aliases":["DEBIAN-CVE-2017-18221","EUVD-2017-9353","GHSA-286w-m7xc-q3hr","SUSE-SU-2018:0834-1","SUSE-SU-2018:0848-1","UBUNTU-CVE-2017-18221","USN-3655-1"],"status":"published","title":"The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users...","description":"The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to cause a denial of service (NR_MLOCK accounting corruption) via crafted use of mlockall and munlockall system calls.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00454,"percentile":0.39603,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2018-03-07T00:00:00Z","modified":"2026-09-01T20:03:46Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.11.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.11.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.11.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","fixed_in":["4.4.0-87.110~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux","fixed_in":["4.4.0-87.110"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-aws","fixed_in":["4.4.0-1026.35"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-gcp","fixed_in":["4.13.0-1002.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-gke","fixed_in":["4.4.0-1022.22"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","fixed_in":["4.13.0-32.35~16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","fixed_in":["4.4.0-1065.73"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","fixed_in":["4.4.0-1067.72"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.6-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.125.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.125.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.125.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.125.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.125.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kgraft-patch-SLE12_Update_33","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-1.3.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.85.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.85.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.85.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.85.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"kgraft-patch-SLE12-SP1_Update_26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-2.3.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.85.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.85.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.85.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.85.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.85.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kgraft-patch-SLE12-SP1_Update_26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-2.3.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.85.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.85.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.85.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.85.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"kgraft-patch-SLE12-SP1_Update_26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-2.3.1"}]}],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-87.110~14.04.1"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1","4.4.0-28.47~14.04.1","4.4.0-31.50~14.04.1","4.4.0-34.53~14.04.1","4.4.0-36.55~14.04.1","4.4.0-38.57~14.04.1","4.4.0-42.62~14.04.1","4.4.0-45.66~14.04.1","4.4.0-47.68~14.04.1","4.4.0-51.72~14.04.1","4.4.0-53.74~14.04.1","4.4.0-57.78~14.04.1","4.4.0-59.80~14.04.1","4.4.0-62.83~14.04.1","4.4.0-63.84~14.04.2","4.4.0-64.85~14.04.1","4.4.0-66.87~14.04.1","4.4.0-67.88~14.04.1","4.4.0-70.91~14.04.1","4.4.0-71.92~14.04.1","4.4.0-72.93~14.04.1","4.4.0-75.96~14.04.1","4.4.0-78.99~14.04.2","4.4.0-79.100~14.04.1","4.4.0-81.104~14.04.1","4.4.0-83.106~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-87.110"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43","4.4.0-28.47","4.4.0-31.50","4.4.0-34.53","4.4.0-36.55","4.4.0-38.57","4.4.0-42.62","4.4.0-43.63","4.4.0-45.66","4.4.0-47.68","4.4.0-51.72","4.4.0-53.74","4.4.0-57.78","4.4.0-59.80","4.4.0-62.83","4.4.0-63.84","4.4.0-64.85","4.4.0-65.86","4.4.0-66.87","4.4.0-67.88","4.4.0-70.91","4.4.0-71.92","4.4.0-72.93","4.4.0-75.96","4.4.0-77.98","4.4.0-78.99","4.4.0-79.100","4.4.0-81.104","4.4.0-83.106"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1026.35"}]}],"versions":["4.4.0-1001.10","4.4.0-1003.12","4.4.0-1004.13","4.4.0-1007.16","4.4.0-1009.18","4.4.0-1011.20","4.4.0-1012.21","4.4.0-1013.22","4.4.0-1016.25","4.4.0-1017.26","4.4.0-1018.27","4.4.0-1020.29","4.4.0-1022.31"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.0-1002.5"}]}],"versions":["4.10.0-1004.4","4.10.0-1006.6","4.10.0-1007.7","4.10.0-1008.8","4.10.0-1009.9"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1022.22"}]}],"versions":["4.4.0-1003.3","4.4.0-1005.6","4.4.0-1006.6","4.4.0-1008.8","4.4.0-1009.9","4.4.0-1010.10","4.4.0-1012.12","4.4.0-1013.13","4.4.0-1014.14","4.4.0-1016.16","4.4.0-1018.18"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.0-32.35~16.04.1"}]}],"versions":["4.8.0-36.36~16.04.1","4.8.0-39.42~16.04.1","4.8.0-41.44~16.04.1","4.8.0-42.45~16.04.1","4.8.0-44.47~16.04.1","4.8.0-45.48~16.04.1","4.8.0-46.49~16.04.1","4.8.0-49.52~16.04.1","4.8.0-51.54~16.04.1","4.8.0-52.55~16.04.1","4.8.0-53.56~16.04.1","4.8.0-54.57~16.04.1","4.8.0-56.61~16.04.1","4.8.0-58.63~16.04.1","4.10.0-27.30~16.04.2","4.10.0-28.32~16.04.2","4.10.0-30.34~16.04.1","4.10.0-32.36~16.04.1","4.10.0-33.37~16.04.1","4.10.0-35.39~16.04.1","4.10.0-37.41~16.04.1","4.10.0-38.42~16.04.1","4.10.0-40.44~16.04.1","4.10.0-42.46~16.04.1","4.13.0-26.29~16.04.2","4.13.0-31.34~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1065.73"}]}],"versions":["4.2.0-1013.19","4.2.0-1014.21","4.3.0-1006.6","4.4.0-1003.4","4.4.0-1004.5","4.4.0-1009.10","4.4.0-1010.12","4.4.0-1010.13","4.4.0-1012.16","4.4.0-1016.22","4.4.0-1017.23","4.4.0-1019.25","4.4.0-1021.27","4.4.0-1023.29","4.4.0-1027.33","4.4.0-1029.36","4.4.0-1034.41","4.4.0-1038.45","4.4.0-1040.47","4.4.0-1042.49","4.4.0-1044.51","4.4.0-1046.53","4.4.0-1048.55","4.4.0-1050.57","4.4.0-1051.58","4.4.0-1052.59","4.4.0-1054.61","4.4.0-1055.62","4.4.0-1057.64","4.4.0-1059.67","4.4.0-1061.69"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1067.72"}]}],"versions":["4.4.0-1012.12","4.4.0-1013.14","4.4.0-1013.15","4.4.0-1015.18","4.4.0-1019.22","4.4.0-1020.23","4.4.0-1022.25","4.4.0-1024.27","4.4.0-1026.29","4.4.0-1030.33","4.4.0-1032.36","4.4.0-1035.39","4.4.0-1039.43","4.4.0-1042.46","4.4.0-1044.48","4.4.0-1046.50","4.4.0-1047.51","4.4.0-1048.52","4.4.0-1050.54","4.4.0-1051.55","4.4.0-1053.57","4.4.0-1054.58","4.4.0-1055.59","4.4.0-1057.61","4.4.0-1058.62","4.4.0-1059.63","4.4.0-1061.66","4.4.0-1063.68"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-149.199"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95","3.13.0-58.97","3.13.0-59.98","3.13.0-61.100","3.13.0-62.102","3.13.0-63.103","3.13.0-65.105","3.13.0-65.106","3.13.0-66.108","3.13.0-67.110","3.13.0-68.111","3.13.0-70.113","3.13.0-71.114","3.13.0-73.116","3.13.0-74.118","3.13.0-76.120","3.13.0-77.121","3.13.0-79.123","3.13.0-83.127","3.13.0-85.129","3.13.0-86.130","3.13.0-86.131","3.13.0-87.133","3.13.0-88.135","3.13.0-91.138","3.13.0-92.139","3.13.0-93.140","3.13.0-95.142","3.13.0-96.143","3.13.0-98.145","3.13.0-100.147","3.13.0-101.148","3.13.0-103.150","3.13.0-105.152","3.13.0-106.153","3.13.0-107.154","3.13.0-108.155","3.13.0-109.156","3.13.0-110.157","3.13.0-111.158","3.13.0-112.159","3.13.0-113.160","3.13.0-115.162","3.13.0-116.163","3.13.0-117.164","3.13.0-119.166","3.13.0-121.170","3.13.0-123.172","3.13.0-125.174","3.13.0-126.175","3.13.0-128.177","3.13.0-129.178","3.13.0-132.181","3.13.0-133.182","3.13.0-135.184","3.13.0-137.186","3.13.0-139.188","3.13.0-141.190","3.13.0-142.191","3.13.0-143.192","3.13.0-144.193","3.13.0-145.194","3.13.0-147.196"],"bundled":11}],"products":[{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://github.com/torvalds/linux/commit/70feee0e1ef331b22cc51f383d532a0d043fbdcc","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://usn.ubuntu.com/3655-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=70feee0e1ef331b22cc51f383d532a0d043fbdcc","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.4","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"https://usn.ubuntu.com/3655-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/103321","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18221"},{"url":"https://github.com/advisories/GHSA-286w-m7xc-q3hr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-18221","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180834-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1010470","tags":["report"]},{"url":"https://bugzilla.suse.com/1012382","tags":["report"]},{"url":"https://bugzilla.suse.com/1045330","tags":["report"]},{"url":"https://bugzilla.suse.com/1062568","tags":["report"]},{"url":"https://bugzilla.suse.com/1063416","tags":["report"]},{"url":"https://bugzilla.suse.com/1066001","tags":["report"]},{"url":"https://bugzilla.suse.com/1067118","tags":["report"]},{"url":"https://bugzilla.suse.com/1068032","tags":["report"]},{"url":"https://bugzilla.suse.com/1072689","tags":["report"]},{"url":"https://bugzilla.suse.com/1072865","tags":["report"]},{"url":"https://bugzilla.suse.com/1074488","tags":["report"]},{"url":"https://bugzilla.suse.com/1075617","tags":["report"]},{"url":"https://bugzilla.suse.com/1075621","tags":["report"]},{"url":"https://bugzilla.suse.com/1077560","tags":["report"]},{"url":"https://bugzilla.suse.com/1078669","tags":["report"]},{"url":"https://bugzilla.suse.com/1078672","tags":["report"]},{"url":"https://bugzilla.suse.com/1078673","tags":["report"]},{"url":"https://bugzilla.suse.com/1078674","tags":["report"]},{"url":"https://bugzilla.suse.com/1080255","tags":["report"]},{"url":"https://bugzilla.suse.com/1080464","tags":["report"]},{"url":"https://bugzilla.suse.com/1080757","tags":["report"]},{"url":"https://bugzilla.suse.com/1082299","tags":["report"]},{"url":"https://bugzilla.suse.com/1083244","tags":["report"]},{"url":"https://bugzilla.suse.com/1083483","tags":["report"]},{"url":"https://bugzilla.suse.com/1083494","tags":["report"]},{"url":"https://bugzilla.suse.com/1083640","tags":["report"]},{"url":"https://bugzilla.suse.com/1084323","tags":["report"]},{"url":"https://bugzilla.suse.com/1085107","tags":["report"]},{"url":"https://bugzilla.suse.com/1085114","tags":["report"]},{"url":"https://bugzilla.suse.com/1085279","tags":["report"]},{"url":"https://bugzilla.suse.com/1085447","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7566","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180848-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1055755","tags":["report"]},{"url":"https://bugzilla.suse.com/1077182","tags":["report"]},{"url":"https://bugzilla.suse.com/1077779","tags":["report"]},{"url":"https://bugzilla.suse.com/1080287","tags":["report"]},{"url":"https://bugzilla.suse.com/1081512","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-18221","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3655-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3655-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12134","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13305","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-17449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-18079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-18203","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-18204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-18208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-3639","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-8822","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-18221","description":"The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to cause a denial of service (NR_MLOCK accounting corruption) via crafted use of mlockall and munlockall system calls.","status":"published","published":"2018-03-07T08:00:00Z","modified":"2024-08-05T21:13:49.211Z","updated_at":"2026-11-02T14:33:21.747294Z"}],"euvd":[{"id":"EUVD-2017-9353","description":"The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to cause a denial of service (NR_MLOCK accounting corruption) via crafted use of mlockall and munlockall system calls.","status":"published","published":"2018-03-07T08:00:00Z","modified":"2024-08-05T21:13:49Z","updated_at":"2026-11-03T02:23:07.6199Z"}],"ghsa":[{"id":"GHSA-286w-m7xc-q3hr","title":"The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users...","description":"The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to cause a denial of service (NR_MLOCK accounting corruption) via crafted use of mlockall and munlockall system calls.","status":"published","published":"2022-05-14T03:20:48Z","modified":"2023-02-02T05:07:41Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:52:33.872402Z"}],"nvd":[{"id":"CVE-2017-18221","description":"The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to cause a denial of service (NR_MLOCK accounting corruption) via crafted use of mlockall and munlockall system calls.","status":"published","published":"2018-03-07T08:29:00.263Z","modified":"2026-06-17T01:12:25.487Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:16.247048Z"}],"osv":[{"id":"CVE-2017-18221","description":"The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to cause a denial of service (NR_MLOCK accounting corruption) via crafted use of mlockall and munlockall system calls.","status":"published","published":"2018-03-07T08:29:00.263Z","modified":"2026-03-15T22:15:36.621864Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-18221","description":"The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to cause a denial of service (NR_MLOCK accounting corruption) via crafted use of mlockall and munlockall system calls.","status":"published","published":"2018-03-07T08:29:00.263Z","modified":"2026-09-01T20:03:46.946172467Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"UBUNTU-CVE-2017-18221","description":"The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to cause a denial of service (NR_MLOCK accounting corruption) via crafted use of mlockall and munlockall system calls.","status":"published","published":"2018-03-07T00:00:00Z","modified":"2026-04-22T11:21:15.162834Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"SUSE-SU-2018:0834-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 12 kernel was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2018-1068: Fixed flaw in the implementation of 32-bit syscall interface\n  for bridging. This allowed a privileged user to arbitrarily write to a limited\n  range of kernel memory (bnc#1085107).\n- CVE-2017-18221: The __munlock_pagevec function allowed local users to cause a\n  denial of service (NR_MLOCK accounting corruption) via crafted use of mlockall\n  and munlockall system calls (bnc#1084323).\n- CVE-2018-1066: Prevent NULL pointer dereference in\n  fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() that allowed an attacker controlling a\n  CIFS server to kernel panic a client that has this server mounted, because an\n  empty TargetInfo field in an NTLMSSP setup negotiation response was mishandled\n  during session recovery (bnc#1083640).\n- CVE-2017-13166: Prevent elevation of privilege vulnerability in the kernel\n  v4l2 video driver (bnc#1072865).\n- CVE-2017-16911: The vhci_hcd driver allowed local attackers to disclose\n  kernel memory addresses. Successful exploitation required that a USB device was\n  attached over IP (bnc#1078674).\n- CVE-2017-15299: The KEYS subsystem mishandled use of add_key for a key that\n  already exists but is uninstantiated, which allowed local users to cause a\n  denial of service (NULL pointer dereference and system crash) or possibly have\n  unspecified other impact via a crafted system call (bnc#1063416).\n- CVE-2017-18208: The madvise_willneed function kernel allowed local users to\n  cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED\n  for a DAX mapping (bnc#1083494).\n- CVE-2018-7566: The ALSA sequencer core initializes the event pool on demand\n  by invoking snd_seq_pool_init() when the first write happens and the pool is\n  empty. A user could have reset the pool size manually via ioctl concurrently,\n  which may have lead UAF or out-of-bound access (bsc#1083483).\n- CVE-2017-18204: The ocfs2_setattr function allowed local users to cause a\n  denial of service (deadlock) via DIO requests (bnc#1083244).\n- CVE-2017-16644: The hdpvr_probe function allowed local users to cause a\n  denial of service (improper error handling and system crash) or possibly have\n  unspecified other impact via a crafted USB device (bnc#1067118).\n- CVE-2018-6927: The futex_requeue function allowed attackers to cause a denial\n  of service (integer overflow) or possibly have unspecified other impact by\n  triggering a negative wake or requeue value (bnc#1080757).\n- CVE-2017-16914: The 'stub_send_ret_submit()' function allowed attackers to\n  cause a denial of service (NULL pointer dereference) via a specially crafted\n  USB over IP packet (bnc#1078669).\n- CVE-2016-7915: The hid_input_field function allowed physically proximate\n  attackers to obtain sensitive information from kernel memory or cause a denial\n  of service (out-of-bounds read) by connecting a device (bnc#1010470).\n- CVE-2017-12190: The bio_map_user_iov and bio_unmap_user functions did\n  unbalanced refcounting when a SCSI I/O vector had small consecutive buffers\n  belonging to the same page. The bio_add_pc_page function merged them into one,\n  but the page reference was never dropped. This caused a memory leak and\n  possible system lockup (exploitable against the host OS by a guest OS user, if\n  a SCSI disk is passed through to a virtual machine) due to an out-of-memory\n  condition (bnc#1062568).\n- CVE-2017-16912: The 'get_pipe()' function allowed attackers to cause a denial\n  of service (out-of-bounds read) via a specially crafted USB over IP packet\n  (bnc#1078673).\n- CVE-2017-16913: The 'stub_recv_cmd_submit()' function when handling\n  CMD_SUBMIT packets allowed attackers to cause a denial of service (arbitrary\n  memory allocation) via a specially crafted USB over IP packet (bnc#1078672).\n- CVE-2018-5332: The rds_message_alloc_sgs() function did not validate a value\n  that is used during DMA page allocation, leading to a heap-based out-of-bounds\n  write (related to the rds_rdma_extra_size function in net/rds/rdma.c)\n  (bnc#1075621).\n- CVE-2018-5333: The rds_cmsg_atomic function in net/rds/rdma.c mishandled\n  cases where page pinning fails or an invalid address is supplied, leading to an\n  rds_atomic_free_op NULL pointer dereference (bnc#1075617).\n- CVE-2017-18017: The tcpmss_mangle_packet function allowed remote attackers to\n  cause a denial of service (use-after-free and memory corruption) or possibly\n  have unspecified other impact by leveraging the presence of xt_TCPMSS in an\n  iptables action (bnc#1074488).\n\nThe following non-security bugs were fixed:\n\n- Fix build on arm64 by defining empty gmb() (bnc#1068032).\n- KEYS: do not let add_key() update an uninstantiated key (bnc#1063416).\n- KEYS: fix writing past end of user-supplied buffer in keyring_read() (bsc#1066001).\n- KEYS: return full count in keyring_read() if buffer is too small (bsc#1066001).\n- include/stddef.h: Move offsetofend() from vfio.h to a generic kernel header (bsc#1077560).\n- ipc/msg: introduce msgctl(MSG_STAT_ANY) (bsc#1072689).\n- ipc/sem: introduce semctl(SEM_STAT_ANY) (bsc#1072689).\n- ipc/shm: introduce shmctl(SHM_STAT_ANY) (bsc#1072689).\n- x86/kaiser: use trampoline stack for kernel entry (bsc#1077560)\n- leds: do not overflow sysfs buffer in led_trigger_show (bsc#1080464).\n- livepatch: __kgr_shadow_get_or_alloc() is local to shadow.c. Shadow variables support (bsc#1082299).\n- livepatch: introduce shadow variable API. Shadow variables support (bsc#1082299)\n- media: v4l2-compat-ioctl32.c: add missing VIDIOC_PREPARE_BUF (bnc#1012382).\n- media: v4l2-compat-ioctl32.c: avoid sizeof(type) (bnc#1012382).\n- media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32 (bnc#1012382).\n- media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32 (bnc#1012382).\n- media: v4l2-compat-ioctl32.c: do not copy back the result for certain errors (bnc#1012382).\n- media: v4l2-compat-ioctl32.c: drop pr_info for unknown buffer type (bnc#1012382).\n- media: v4l2-compat-ioctl32.c: fix the indentation (bnc#1012382).\n- media: v4l2-compat-ioctl32.c: move 'helper' functions to __get/put_v4l2_format32 (bnc#1012382).\n- media: v4l2-compat-ioctl32: Copy v4l2_window-\u003eglobal_alpha (bnc#1012382).\n- media: v4l2-ioctl.c: do not copy back the result for -ENOTTY (bnc#1012382).\n- netfilter: ebtables: CONFIG_COMPAT: do not trust userland offsets (bsc#1085107).\n- netfilter: ebtables: fix erroneous reject of last rule (bsc#1085107).\n- packet: only call dev_add_pack() on freshly allocated fanout instances\n- pipe: cap initial pipe capacity according to pipe-max-size limit (bsc#1045330).\n- x86/espfix: Fix return stack in do_double_fault() (bsc#1085279).\n","status":"published","published":"2018-03-28T14:17:49Z","modified":"2026-02-04T03:54:59.456038Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:0848-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2018-1068: Fixed flaw in the implementation of 32-bit syscall interface\n  for bridging. This allowed a privileged user to arbitrarily write to a limited\n  range of kernel memory (bnc#1085107).\n- CVE-2017-18221: The __munlock_pagevec function allowed local users to cause a\n  denial of service (NR_MLOCK accounting corruption) via crafted use of mlockall\n  and munlockall system calls (bnc#1084323).\n- CVE-2018-1066: Prevent NULL pointer dereference in\n  fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() that allowed an attacker controlling a\n  CIFS server to kernel panic a client that has this server mounted, because an\n  empty TargetInfo field in an NTLMSSP setup negotiation response was mishandled\n  during session recovery (bnc#1083640).\n- CVE-2017-13166: Prevent elevation of privilege vulnerability in the kernel\n  v4l2 video driver (bnc#1072865).\n- CVE-2017-16911: The vhci_hcd driver allowed local attackers to disclose\n  kernel memory addresses. Successful exploitation required that a USB device was\n  attached over IP (bnc#1078674).\n- CVE-2017-15299: The KEYS subsystem mishandled use of add_key for a key that\n  already exists but is uninstantiated, which allowed local users to cause a\n  denial of service (NULL pointer dereference and system crash) or possibly have\n  unspecified other impact via a crafted system call (bnc#1063416).\n- CVE-2017-18208: The madvise_willneed function kernel allowed local users to\n  cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED\n  for a DAX mapping (bnc#1083494).\n- CVE-2018-7566: The ALSA sequencer core initializes the event pool on demand\n  by invoking snd_seq_pool_init() when the first write happens and the pool is\n  empty. A user could have reset the pool size manually via ioctl concurrently,\n  which may have lead UAF or out-of-bound access (bsc#1083483).\n- CVE-2017-18204: The ocfs2_setattr function allowed local users to cause a\n  denial of service (deadlock) via DIO requests (bnc#1083244).\n- CVE-2017-16644: The hdpvr_probe function allowed local users to cause a\n  denial of service (improper error handling and system crash) or possibly have\n  unspecified other impact via a crafted USB device (bnc#1067118).\n- CVE-2018-6927: The futex_requeue function allowed attackers to cause a denial\n  of service (integer overflow) or possibly have unspecified other impact by\n  triggering a negative wake or requeue value (bnc#1080757).\n- CVE-2017-16914: The 'stub_send_ret_submit()' function allowed attackers to\n  cause a denial of service (NULL pointer dereference) via a specially crafted\n  USB over IP packet (bnc#1078669).\n- CVE-2016-7915: The hid_input_field function allowed physically proximate\n  attackers to obtain sensitive information from kernel memory or cause a denial\n  of service (out-of-bounds read) by connecting a device (bnc#1010470).\n- CVE-2017-12190: The bio_map_user_iov and bio_unmap_user functions did\n  unbalanced refcounting when a SCSI I/O vector had small consecutive buffers\n  belonging to the same page. The bio_add_pc_page function merged them into one,\n  but the page reference was never dropped. This caused a memory leak and\n  possible system lockup (exploitable against the host OS by a guest OS user, if\n  a SCSI disk is passed through to a virtual machine) due to an out-of-memory\n  condition (bnc#1062568).\n- CVE-2017-16912: The 'get_pipe()' function allowed attackers to cause a denial\n  of service (out-of-bounds read) via a specially crafted USB over IP packet\n  (bnc#1078673).\n- CVE-2017-16913: The 'stub_recv_cmd_submit()' function when handling\n  CMD_SUBMIT packets allowed attackers to cause a denial of service (arbitrary\n  memory allocation) via a specially crafted USB over IP packet (bnc#1078672).\n- CVE-2018-5332: The rds_message_alloc_sgs() function did not validate a value\n  that is used during DMA page allocation, leading to a heap-based out-of-bounds\n  write (related to the rds_rdma_extra_size function in net/rds/rdma.c)\n  (bnc#1075621).\n- CVE-2018-5333: The rds_cmsg_atomic function in net/rds/rdma.c mishandled\n  cases where page pinning fails or an invalid address is supplied, leading to an\n  rds_atomic_free_op NULL pointer dereference (bnc#1075617).\n- CVE-2017-18017: The tcpmss_mangle_packet function allowed remote attackers to\n  cause a denial of service (use-after-free and memory corruption) or possibly\n  have unspecified other impact by leveraging the presence of xt_TCPMSS in an\n  iptables action (bnc#1074488).\n  \nThe following non-security bugs were fixed:\n\n- KEYS: do not let add_key() update an uninstantiated key (bnc#1063416).\n- KEYS: fix writing past end of user-supplied buffer in keyring_read() (bsc#1066001).\n- KEYS: return full count in keyring_read() if buffer is too small (bsc#1066001).\n- NFS: Add a cond_resched() to nfs_commit_release_pages() (bsc#1077779).\n- btrfs: qgroup: move noisy underflow warning to debugging build (bsc#1055755 and bsc#1080287).\n- ipc/msg: introduce msgctl(MSG_STAT_ANY) (bsc#1072689).\n- ipc/sem: introduce semctl(SEM_STAT_ANY) (bsc#1072689).\n- ipc/shm: introduce shmctl(SHM_STAT_ANY) (bsc#1072689).\n- x86/kaiser: use trampoline stack for kernel entry (bsc#1077560)\n- leds: do not overflow sysfs buffer in led_trigger_show (bsc#1080464).\n- livepatch: __kgr_shadow_get_or_alloc() is local to shadow.c. Shadow variables support (bsc#1082299).\n- livepatch: introduce shadow variable API. Shadow variables support (bsc#1082299)\n- media: v4l2-compat-ioctl32.c: add missing VIDIOC_PREPARE_BUF (bnc#1012382).\n- media: v4l2-compat-ioctl32.c: avoid sizeof(type) (bnc#1012382).\n- media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32 (bnc#1012382).\n- media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32 (bnc#1012382).\n- media: v4l2-compat-ioctl32.c: do not copy back the result for certain errors (bnc#1012382).\n- media: v4l2-compat-ioctl32.c: drop pr_info for unknown buffer type (bnc#1012382).\n- media: v4l2-compat-ioctl32.c: fix the indentation (bnc#1012382).\n- media: v4l2-compat-ioctl32.c: move 'helper' functions to __get/put_v4l2_format32 (bnc#1012382).\n- media: v4l2-compat-ioctl32: Copy v4l2_window-\u003eglobal_alpha (bnc#1012382).\n- media: v4l2-ioctl.c: do not copy back the result for -ENOTTY (bnc#1012382).\n- netfilter: ebtables: CONFIG_COMPAT: do not trust userland offsets (bsc#1085107).\n- netfilter: ebtables: fix erroneous reject of last rule (bsc#1085107).\n- packet: only call dev_add_pack() on freshly allocated fanout instances\n- pipe: cap initial pipe capacity according to pipe-max-size limit (bsc#1045330).\n- powerpc/64s: Improve RFI L1-D cache flush fallback (bsc#1068032, bsc#1077182).\n- powerpc/numa: Invalidate numa_cpu_lookup_table on cpu remove (bsc#1081512).\n- powerpc/powernv: Support firmware disable of RFI flush (bsc#1068032, bsc#1077182).\n- powerpc/powernv: Support firmware disable of RFI flush (bsc#1068032, bsc#1077182).\n- powerpc/pseries: Support firmware disable of RFI flush (bsc#1068032, bsc#1077182).\n- powerpc/pseries: Support firmware disable of RFI flush (bsc#1068032, bsc#1077182).\n- rfi-flush: Move the logic to avoid a redo into the debugfs code (bsc#1068032, bsc#1077182).\n- rfi-flush: Switch to new linear fallback flush (bsc#1068032, bsc#1077182).\n","status":"published","published":"2018-03-29T12:28:31Z","modified":"2025-05-02T04:05:33.356536Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"USN-3655-1","title":"linux vulnerabilities","description":"Jann Horn and Ken Johnson discovered that microprocessors utilizing\nspeculative execution of a memory read may allow unauthorized memory\nreads via a sidechannel attack. This flaw is known as Spectre\nVariant 4. A local attacker could use this to expose sensitive\ninformation, including kernel memory. (CVE-2018-3639)\n\nJan H. Schönherr discovered that the Xen subsystem did not properly handle\nblock IO merges correctly in some situations. An attacker in a guest vm\ncould use this to cause a denial of service (host crash) or possibly gain\nadministrative privileges in the host. (CVE-2017-12134)\n\nIt was discovered that the Bluetooth HIP Protocol implementation in the\nLinux kernel did not properly validate HID connection setup information. An\nattacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2017-13220)\n\nIt was discovered that a buffer overread vulnerability existed in the\nkeyring subsystem of the Linux kernel. A local attacker could possibly use\nthis to expose sensitive information (kernel memory). (CVE-2017-13305)\n\nIt was discovered that the netlink subsystem in the Linux kernel did not\nproperly restrict observations of netlink messages to the appropriate net\nnamespace. A local attacker could use this to expose sensitive information\n(kernel netlink traffic). (CVE-2017-17449)\n\nIt was discovered that a race condition existed in the i8042 serial device\ndriver implementation in the Linux kernel. A physically proximate attacker\ncould use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2017-18079)\n\nIt was discovered that a race condition existed in the Device Mapper\ncomponent of the Linux kernel. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2017-18203)\n\nIt was discovered that a race condition existed in the OCFS2 file system\nimplementation in the Linux kernel. A local attacker could use this to\ncause a denial of service (kernel deadlock). (CVE-2017-18204)\n\nIt was discovered that an infinite loop could occur in the madvise(2)\nimplementation in the Linux kernel in certain circumstances. A local\nattacker could use this to cause a denial of service (system hang).\n(CVE-2017-18208)\n\nKefeng Wang discovered that a race condition existed in the memory locking\nimplementation in the Linux kernel. A local attacker could use this to\ncause a denial of service. (CVE-2017-18221)\n\nSilvio Cesare discovered a buffer overwrite existed in the NCPFS\nimplementation in the Linux kernel. A remote attacker controlling a\nmalicious NCPFS server could use this to cause a denial of service (system\ncrash) or possibly execute arbitrary code. (CVE-2018-8822)\n","status":"published","published":"2018-05-22T03:36:42Z","modified":"2026-06-03T14:03:30.428458954Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}