{"id":"CVE-2017-9605","aliases":["DEBIAN-CVE-2017-9605","DSA-3927-1","DSA-3945-1","EUVD-2017-18536","GHSA-547f-j6j7-jjcm","MGASA-2017-0186","MGASA-2017-0187","MGASA-2017-0188","UBUNTU-CVE-2017-9605","USN-3360-1","USN-3364-1","USN-3364-2","USN-3364-3","USN-3371-1"],"status":"published","title":"The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in...","description":"The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.11.4 defines a backup_handle variable but does not give it an initial value. If one attempts to create a GB surface, with a previously allocated DMA buffer to be used as a backup buffer, the backup_handle variable does not get written to and is then later returned to user space, allowing local users to obtain sensitive information from uninitialized kernel memory via a crafted ioctl call.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00399,"percentile":0.34449,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2017-06-13T00:00:00Z","modified":"2026-09-01T20:03:52Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.11.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.11.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.11.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux","fixed_in":["3.13.0-125.174"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","fixed_in":["4.4.0-87.110~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux","fixed_in":["4.4.0-87.110"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-aws","fixed_in":["4.4.0-1026.35"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-gke","fixed_in":["4.4.0-1022.22"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","fixed_in":["4.10.0-32.36~16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","fixed_in":["4.4.0-1065.73"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","fixed_in":["4.4.0-1067.72"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.6-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.30-2+deb9u3"}]}],"versions":["4.9.30-2","4.9.30-2+deb9u1","4.9.30-2+deb9u2","4.9.30-2+deb9u2~bpo8+1"],"bundled":10},{"source":"osv","ecosystem":"Debian:8","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.43-2+deb8u3"}]}],"versions":["3.16.36-1","3.16.36-1+deb8u1","3.16.36-1+deb8u1~bpo70+1","3.16.36-1+deb8u2","3.16.36-1+deb8u2~bpo70+1","3.16.39-1","3.16.39-1+deb8u1","3.16.39-1+deb8u1~bpo70+1","3.16.39-1+deb8u1~bpo70+1+gcc4.4","3.16.39-1+deb8u2","3.16.39-1~bpo70+1","3.16.43-1","3.16.43-2","3.16.43-2+deb8u1","3.16.43-2+deb8u2","3.16.7-ckt11-1","3.16.7-ckt11-1+deb8u1","3.16.7-ckt11-1+deb8u2","3.16.7-ckt11-1+deb8u2~bpo70+1","3.16.7-ckt11-1+deb8u3","3.16.7-ckt11-1+deb8u3~bpo70+1","3.16.7-ckt11-1+deb8u4","3.16.7-ckt11-1+deb8u4~bpo70+1","3.16.7-ckt11-1+deb8u5","3.16.7-ckt11-1+deb8u6","3.16.7-ckt11-1+deb8u6~bpo70+1","3.16.7-ckt11-1~bpo70+1","3.16.7-ckt17-1","3.16.7-ckt20-1","3.16.7-ckt20-1+deb8u1","3.16.7-ckt20-1+deb8u2","3.16.7-ckt20-1+deb8u2~bpo70+1","3.16.7-ckt20-1+deb8u3","3.16.7-ckt20-1+deb8u3~bpo70+1","3.16.7-ckt20-1+deb8u4","3.16.7-ckt20-1+deb8u4~bpo70+1","3.16.7-ckt25-1","3.16.7-ckt25-1~bpo70+1","3.16.7-ckt25-2","3.16.7-ckt25-2+deb8u1","3.16.7-ckt25-2+deb8u2","3.16.7-ckt25-2+deb8u3","3.16.7-ckt25-2+deb8u3~bpo70+1","3.16.7-ckt25-2~bpo70+1","3.16.7-ckt9-2","3.16.7-ckt9-3","3.16.7-ckt9-3~deb8u1","3.16.7-ckt9-3~deb8u1~bpo70+1"],"bundled":12},{"source":"osv","ecosystem":"Mageia:5","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.74-1.mga5"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.74-1.mga5"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.22-7.mga5"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.22-7.mga5"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-43.mga5"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.74-1.mga5"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.74-1.mga5"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-125.174"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95","3.13.0-58.97","3.13.0-59.98","3.13.0-61.100","3.13.0-62.102","3.13.0-63.103","3.13.0-65.105","3.13.0-65.106","3.13.0-66.108","3.13.0-67.110","3.13.0-68.111","3.13.0-70.113","3.13.0-71.114","3.13.0-73.116","3.13.0-74.118","3.13.0-76.120","3.13.0-77.121","3.13.0-79.123","3.13.0-83.127","3.13.0-85.129","3.13.0-86.130","3.13.0-86.131","3.13.0-87.133","3.13.0-88.135","3.13.0-91.138","3.13.0-92.139","3.13.0-93.140","3.13.0-95.142","3.13.0-96.143","3.13.0-98.145","3.13.0-100.147","3.13.0-101.148","3.13.0-103.150","3.13.0-105.152","3.13.0-106.153","3.13.0-107.154","3.13.0-108.155","3.13.0-109.156","3.13.0-110.157","3.13.0-111.158","3.13.0-112.159","3.13.0-113.160","3.13.0-115.162","3.13.0-116.163","3.13.0-117.164","3.13.0-119.166","3.13.0-121.170","3.13.0-123.172"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-87.110~14.04.1"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1","4.4.0-28.47~14.04.1","4.4.0-31.50~14.04.1","4.4.0-34.53~14.04.1","4.4.0-36.55~14.04.1","4.4.0-38.57~14.04.1","4.4.0-42.62~14.04.1","4.4.0-45.66~14.04.1","4.4.0-47.68~14.04.1","4.4.0-51.72~14.04.1","4.4.0-53.74~14.04.1","4.4.0-57.78~14.04.1","4.4.0-59.80~14.04.1","4.4.0-62.83~14.04.1","4.4.0-63.84~14.04.2","4.4.0-64.85~14.04.1","4.4.0-66.87~14.04.1","4.4.0-67.88~14.04.1","4.4.0-70.91~14.04.1","4.4.0-71.92~14.04.1","4.4.0-72.93~14.04.1","4.4.0-75.96~14.04.1","4.4.0-78.99~14.04.2","4.4.0-79.100~14.04.1","4.4.0-81.104~14.04.1","4.4.0-83.106~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-87.110"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43","4.4.0-28.47","4.4.0-31.50","4.4.0-34.53","4.4.0-36.55","4.4.0-38.57","4.4.0-42.62","4.4.0-43.63","4.4.0-45.66","4.4.0-47.68","4.4.0-51.72","4.4.0-53.74","4.4.0-57.78","4.4.0-59.80","4.4.0-62.83","4.4.0-63.84","4.4.0-64.85","4.4.0-65.86","4.4.0-66.87","4.4.0-67.88","4.4.0-70.91","4.4.0-71.92","4.4.0-72.93","4.4.0-75.96","4.4.0-77.98","4.4.0-78.99","4.4.0-79.100","4.4.0-81.104","4.4.0-83.106"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1026.35"}]}],"versions":["4.4.0-1001.10","4.4.0-1003.12","4.4.0-1004.13","4.4.0-1007.16","4.4.0-1009.18","4.4.0-1011.20","4.4.0-1012.21","4.4.0-1013.22","4.4.0-1016.25","4.4.0-1017.26","4.4.0-1018.27","4.4.0-1020.29","4.4.0-1022.31"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1022.22"}]}],"versions":["4.4.0-1003.3","4.4.0-1005.6","4.4.0-1006.6","4.4.0-1008.8","4.4.0-1009.9","4.4.0-1010.10","4.4.0-1012.12","4.4.0-1013.13","4.4.0-1014.14","4.4.0-1016.16","4.4.0-1018.18"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-32.36~16.04.1"}]}],"versions":["4.8.0-36.36~16.04.1","4.8.0-39.42~16.04.1","4.8.0-41.44~16.04.1","4.8.0-42.45~16.04.1","4.8.0-44.47~16.04.1","4.8.0-45.48~16.04.1","4.8.0-46.49~16.04.1","4.8.0-49.52~16.04.1","4.8.0-51.54~16.04.1","4.8.0-52.55~16.04.1","4.8.0-53.56~16.04.1","4.8.0-54.57~16.04.1","4.8.0-56.61~16.04.1","4.8.0-58.63~16.04.1","4.10.0-27.30~16.04.2","4.10.0-28.32~16.04.2","4.10.0-30.34~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1065.73"}]}],"versions":["4.2.0-1013.19","4.2.0-1014.21","4.3.0-1006.6","4.4.0-1003.4","4.4.0-1004.5","4.4.0-1009.10","4.4.0-1010.12","4.4.0-1010.13","4.4.0-1012.16","4.4.0-1016.22","4.4.0-1017.23","4.4.0-1019.25","4.4.0-1021.27","4.4.0-1023.29","4.4.0-1027.33","4.4.0-1029.36","4.4.0-1034.41","4.4.0-1038.45","4.4.0-1040.47","4.4.0-1042.49","4.4.0-1044.51","4.4.0-1046.53","4.4.0-1048.55","4.4.0-1050.57","4.4.0-1051.58","4.4.0-1052.59","4.4.0-1054.61","4.4.0-1055.62","4.4.0-1057.64","4.4.0-1059.67","4.4.0-1061.69"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1067.72"}]}],"versions":["4.4.0-1012.12","4.4.0-1013.14","4.4.0-1013.15","4.4.0-1015.18","4.4.0-1019.22","4.4.0-1020.23","4.4.0-1022.25","4.4.0-1024.27","4.4.0-1026.29","4.4.0-1030.33","4.4.0-1032.36","4.4.0-1035.39","4.4.0-1039.43","4.4.0-1042.46","4.4.0-1044.48","4.4.0-1046.50","4.4.0-1047.51","4.4.0-1048.52","4.4.0-1050.54","4.4.0-1051.55","4.4.0-1053.57","4.4.0-1054.58","4.4.0-1055.59","4.4.0-1057.61","4.4.0-1058.62","4.4.0-1059.63","4.4.0-1061.66","4.4.0-1063.68"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-125.174"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95","3.13.0-58.97","3.13.0-59.98","3.13.0-61.100","3.13.0-62.102","3.13.0-63.103","3.13.0-65.105","3.13.0-65.106","3.13.0-66.108","3.13.0-67.110","3.13.0-68.111","3.13.0-70.113","3.13.0-71.114","3.13.0-73.116","3.13.0-74.118","3.13.0-76.120","3.13.0-77.121","3.13.0-79.123","3.13.0-83.127","3.13.0-85.129","3.13.0-86.130","3.13.0-86.131","3.13.0-87.133","3.13.0-88.135","3.13.0-91.138","3.13.0-92.139","3.13.0-93.140","3.13.0-95.142","3.13.0-96.143","3.13.0-98.145","3.13.0-100.147","3.13.0-101.148","3.13.0-103.150","3.13.0-105.152","3.13.0-106.153","3.13.0-107.154","3.13.0-108.155","3.13.0-109.156","3.13.0-110.157","3.13.0-111.158","3.13.0-112.159","3.13.0-113.160","3.13.0-115.162","3.13.0-116.163","3.13.0-117.164","3.13.0-119.166","3.13.0-121.170","3.13.0-123.172"],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-87.110"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43","4.4.0-28.47","4.4.0-31.50","4.4.0-34.53","4.4.0-36.55","4.4.0-38.57","4.4.0-42.62","4.4.0-43.63","4.4.0-45.66","4.4.0-47.68","4.4.0-51.72","4.4.0-53.74","4.4.0-57.78","4.4.0-59.80","4.4.0-62.83","4.4.0-63.84","4.4.0-64.85","4.4.0-65.86","4.4.0-66.87","4.4.0-67.88","4.4.0-70.91","4.4.0-71.92","4.4.0-72.93","4.4.0-75.96","4.4.0-77.98","4.4.0-78.99","4.4.0-79.100","4.4.0-81.104","4.4.0-83.106"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1065.73"}]}],"versions":["4.2.0-1013.19","4.2.0-1014.21","4.3.0-1006.6","4.4.0-1003.4","4.4.0-1004.5","4.4.0-1009.10","4.4.0-1010.12","4.4.0-1010.13","4.4.0-1012.16","4.4.0-1016.22","4.4.0-1017.23","4.4.0-1019.25","4.4.0-1021.27","4.4.0-1023.29","4.4.0-1027.33","4.4.0-1029.36","4.4.0-1034.41","4.4.0-1038.45","4.4.0-1040.47","4.4.0-1042.49","4.4.0-1044.51","4.4.0-1046.53","4.4.0-1048.55","4.4.0-1050.57","4.4.0-1051.58","4.4.0-1052.59","4.4.0-1054.61","4.4.0-1055.62","4.4.0-1057.64","4.4.0-1059.67","4.4.0-1061.69"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1067.72"}]}],"versions":["4.4.0-1012.12","4.4.0-1013.14","4.4.0-1013.15","4.4.0-1015.18","4.4.0-1019.22","4.4.0-1020.23","4.4.0-1022.25","4.4.0-1024.27","4.4.0-1026.29","4.4.0-1030.33","4.4.0-1032.36","4.4.0-1035.39","4.4.0-1039.43","4.4.0-1042.46","4.4.0-1044.48","4.4.0-1046.50","4.4.0-1047.51","4.4.0-1048.52","4.4.0-1050.54","4.4.0-1051.55","4.4.0-1053.57","4.4.0-1054.58","4.4.0-1055.59","4.4.0-1057.61","4.4.0-1058.62","4.4.0-1059.63","4.4.0-1061.66","4.4.0-1063.68"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-87.110~14.04.1"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1","4.4.0-28.47~14.04.1","4.4.0-31.50~14.04.1","4.4.0-34.53~14.04.1","4.4.0-36.55~14.04.1","4.4.0-38.57~14.04.1","4.4.0-42.62~14.04.1","4.4.0-45.66~14.04.1","4.4.0-47.68~14.04.1","4.4.0-51.72~14.04.1","4.4.0-53.74~14.04.1","4.4.0-57.78~14.04.1","4.4.0-59.80~14.04.1","4.4.0-62.83~14.04.1","4.4.0-63.84~14.04.2","4.4.0-64.85~14.04.1","4.4.0-66.87~14.04.1","4.4.0-67.88~14.04.1","4.4.0-70.91~14.04.1","4.4.0-71.92~14.04.1","4.4.0-72.93~14.04.1","4.4.0-75.96~14.04.1","4.4.0-78.99~14.04.2","4.4.0-79.100~14.04.1","4.4.0-81.104~14.04.1","4.4.0-83.106~14.04.1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1026.35"}]}],"versions":["4.4.0-1001.10","4.4.0-1003.12","4.4.0-1004.13","4.4.0-1007.16","4.4.0-1009.18","4.4.0-1011.20","4.4.0-1012.21","4.4.0-1013.22","4.4.0-1016.25","4.4.0-1017.26","4.4.0-1018.27","4.4.0-1020.29","4.4.0-1022.31"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1022.22"}]}],"versions":["4.4.0-1003.3","4.4.0-1005.6","4.4.0-1006.6","4.4.0-1008.8","4.4.0-1009.9","4.4.0-1010.10","4.4.0-1012.12","4.4.0-1013.13","4.4.0-1014.14","4.4.0-1016.16","4.4.0-1018.18"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-28.32~16.04.2"}]}],"versions":["4.8.0-36.36~16.04.1","4.8.0-39.42~16.04.1","4.8.0-41.44~16.04.1","4.8.0-42.45~16.04.1","4.8.0-44.47~16.04.1","4.8.0-45.48~16.04.1","4.8.0-46.49~16.04.1","4.8.0-49.52~16.04.1","4.8.0-51.54~16.04.1","4.8.0-52.55~16.04.1","4.8.0-53.56~16.04.1","4.8.0-54.57~16.04.1","4.8.0-56.61~16.04.1","4.8.0-58.63~16.04.1","4.10.0-27.30~16.04.2"],"bundled":4}],"products":[{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://www.debian.org/security/2017/dsa-3927","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://github.com/torvalds/linux/commit/07678eca2cf9c9a18584e546c2b2a0d0c9a3150c","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"http://www.debian.org/security/2017/dsa-3945","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/99095","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=07678eca2cf9c9a18584e546c2b2a0d0c9a3150c","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9605"},{"url":"https://github.com/advisories/GHSA-547f-j6j7-jjcm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-9605","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0186.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21141","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21043","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20886","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20803","tags":["report"]},{"url":"https://xenbits.xen.org/xsa/advisory-216.html","tags":["advisory"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.69","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.70","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.71","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.72","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.73","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.74","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2017-0187.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21149","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2017-0188.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9605","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/06/13/2","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3358-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3359-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3360-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3360-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3364-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3364-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3364-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3371-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9605","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9900","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8944","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8963","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8964","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8966","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8967","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7895","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8925","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000380","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9150","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-9605","description":"The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.11.4 defines a backup_handle variable but does not give it an initial value. If one attempts to create a GB surface, with a previously allocated DMA buffer to be used as a backup buffer, the backup_handle variable does not get written to and is then later returned to user space, allowing local users to obtain sensitive information from uninitialized kernel memory via a crafted ioctl call.","status":"published","published":"2017-06-13T19:00:00Z","modified":"2024-08-05T17:11:02.363Z","updated_at":"2026-11-02T14:33:13.606903Z"}],"euvd":[{"id":"EUVD-2017-18536","description":"The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.11.4 defines a backup_handle variable but does not give it an initial value. If one attempts to create a GB surface, with a previously allocated DMA buffer to be used as a backup buffer, the backup_handle variable does not get written to and is then later returned to user space, allowing local users to obtain sensitive information from uninitialized kernel memory via a crafted ioctl call.","status":"published","published":"2017-06-13T19:00:00Z","modified":"2024-08-05T17:11:02Z","updated_at":"2026-11-03T02:23:27.257081Z"}],"ghsa":[{"id":"GHSA-547f-j6j7-jjcm","title":"The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in...","description":"The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.11.4 defines a backup_handle variable but does not give it an initial value. If one attempts to create a GB surface, with a previously allocated DMA buffer to be used as a backup buffer, the backup_handle variable does not get written to and is then later returned to user space, allowing local users to obtain sensitive information from uninitialized kernel memory via a crafted ioctl call.","status":"published","published":"2022-05-17T00:26:31Z","modified":"2023-02-03T05:01:45Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:53:02.192117Z"}],"nvd":[{"id":"CVE-2017-9605","description":"The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.11.4 defines a backup_handle variable but does not give it an initial value. If one attempts to create a GB surface, with a previously allocated DMA buffer to be used as a backup buffer, the backup_handle variable does not get written to and is then later returned to user space, allowing local users to obtain sensitive information from uninitialized kernel memory via a crafted ioctl call.","status":"published","published":"2017-06-13T19:29:00.393Z","modified":"2026-06-17T01:28:33.703Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:C/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:50.782497Z"}],"osv":[{"id":"CVE-2017-9605","description":"The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.11.4 defines a backup_handle variable but does not give it an initial value. If one attempts to create a GB surface, with a previously allocated DMA buffer to be used as a backup buffer, the backup_handle variable does not get written to and is then later returned to user space, allowing local users to obtain sensitive information from uninitialized kernel memory via a crafted ioctl call.","status":"published","published":"2017-06-13T19:29:00.393Z","modified":"2026-04-16T06:26:18.105165022Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"DEBIAN-CVE-2017-9605","description":"The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.11.4 defines a backup_handle variable but does not give it an initial value. If one attempts to create a GB surface, with a previously allocated DMA buffer to be used as a backup buffer, the backup_handle variable does not get written to and is then later returned to user space, allowing local users to obtain sensitive information from uninitialized kernel memory via a crafted ioctl call.","status":"published","published":"2017-06-13T19:29:00.393Z","modified":"2026-09-01T20:03:52.245785138Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-9605","description":"The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.11.4 defines a backup_handle variable but does not give it an initial value. If one attempts to create a GB surface, with a previously allocated DMA buffer to be used as a backup buffer, the backup_handle variable does not get written to and is then later returned to user space, allowing local users to obtain sensitive information from uninitialized kernel memory via a crafted ioctl call.","status":"published","published":"2017-06-13T00:00:00Z","modified":"2026-04-22T11:37:29.707363Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"DSA-3927-1","title":"linux - security update","status":"published","published":"2017-08-07T00:00:00Z","modified":"2026-03-09T01:19:59.802768Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"DSA-3945-1","title":"linux - security update","status":"published","published":"2017-08-17T00:00:00Z","modified":"2026-03-09T01:20:40.31278Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0186","title":"Updated kernel packages fixes critical security vulnerabilities","description":"This kernel update is based on upstream 4.4.74 and fixes at least\nthe following security issues:\n\nThe ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel through\n4.11.1 mishandles reference counts, which allows local users to cause a\ndenial of service (use-after-free) or possibly have unspecified other\nimpact via a failed SIOCGIFADDR ioctl call for an IPX interface\n(CVE-2017-7487).\n\nThe inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the\nLinux kernel through 4.10.15 allows attackers to cause a denial of service\n(double free) or possibly have unspecified other impact by leveraging use\nof the accept system call (CVE-2017-8890).\n\nThe IPv6 fragmentation implementation in the Linux kernel through 4.11.1\ndoes not consider that the nexthdr field may be associated with an invalid\noption, which allows local users to cause a denial of service (out-of-bounds\nread and BUG) or possibly have unspecified other impact via crafted socket\nand send system calls (CVE-2017-9074).\n\nThe sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel\nthrough 4.11.1 mishandles inheritance, which allows local users to cause a\ndenial of service or possibly have unspecified other impact via crafted\nsystem calls, a related issue to CVE-2017-8890 (CVE-2017-9075).\n\nThe dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel\nthrough 4.11.1 mishandles inheritance, which allows local users to cause a\ndenial of service or possibly have unspecified other impact via crafted\nsystem calls, a related issue to CVE-2017-8890 (CVE-2017-9076).\n\nThe tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel\nthrough 4.11.1 mishandles inheritance, which allows local users to cause a\ndenial of service or possibly have unspecified other impact via crafted\nsystem calls, a related issue to CVE-2017-8890 (CVE-2017-9077).\n\nThe __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel\nthrough 4.11.3 is too late in checking whether an overwrite of an skb data\nstructure may occur, which allows local users to cause a denial of service\n(system crash) via crafted system calls (CVE-2017-9242).\n\nThe vmw_gb_surface_define_ioctl function (accessible via\nDRM_IOCTL_VMW_GB_SURFACE_CREATE) in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c\nin the Linux kernel through 4.11.4 defines a backup_handle variable but\ndoes not give it an initial value. If one attempts to create a GB surface,\nwith a previously allocated DMA buffer to be used as a backup buffer, the\nbackup_handle variable does not get written to and is then later returned\nto user space, allowing local users to obtain sensitive information from\nuninitialized kernel memory via a crafted ioctl call (CVE-2017-9605).\n\nA vulnerability was found in the Linux kernel's lp_setup() function where it\ndoesn't apply any bounds checking when passing \"lp=none\". This can result\ninto overflow of the parport_nr[] array. An attacker with control over kernel\ncommand line can overwrite kernel code and data with fixed (0xff) values\n(CVE-2017-1000363).\n\nA flaw was found in the way memory was being allocated on the stack for\nuser space binaries. If heap (or different memory region) and stack memory\nregions were adjacent to each other, an attacker could use this flaw to\njump over the stack guard gap, cause controlled memory corruption on process\nstack or the adjacent memory region, and thus increase their privileges on\nthe system. This is a kernel-side mitigation which increases the stack guard\ngap size from one page to 1 MiB to make successful exploitation of this\nissue more difficult (CVE-2017-1000364).\n\nThe Linux Kernel imposes a size restriction on the arguments and\nenvironmental strings passed through RLIMIT_STACK/RLIM_INFINITY(1/4 of\nthe size), but does not take the argument and environment pointers into\naccount, which allows attackers to bypass this limitation. This affects\nLinux Kernel versions 4.11.5 and earlier (CVE-2017-1000365).\n\nsound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a\ndata race in the ALSA /dev/snd/timer driver resulting in local users being\nable to read information belonging to other users, i.e., uninitialized\nmemory contents may be disclosed when a read and an ioctl happen at the\nsame time (CVE-2017-1000380).\n\nThe block interface response structure has some discontiguous fields.\nCertain backends populate the structure fields of an otherwise\nuninitialized instance of this structure on their stacks, leaking\ndata through the (internal or trailing) padding field. A malicious\nunprivileged guest may be able to obtain sensitive information from the\nhost or other guests (XSA-216).\n\nNOTE! The CVE-2017-1000364 and CVE-2017-1000365 issues are part of a set\nof issues known as Stack Clash. The fixes have components in both glibc\nand the kernel. The glibc fix will be included in a separate update\nadvisory (mga#20803).\n\nOther changes in this kernel:\n- add support for rtl8812au wireless (mga#21043)\n- enable support for SMB2 (mga#20886)\n\nFor other upstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2017-06-26T21:37:03Z","modified":"2026-04-16T06:23:39.849054254Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"MGASA-2017-0187","title":"Updated kernel-tmb packages fixes critical security vulnerabilities","description":"This kernel-tmb update is based on upstream 4.4.74 and fixes at least\nthe following security issues:\n\nThe ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel through\n4.11.1 mishandles reference counts, which allows local users to cause a\ndenial of service (use-after-free) or possibly have unspecified other\nimpact via a failed SIOCGIFADDR ioctl call for an IPX interface\n(CVE-2017-7487).\n\nThe inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the\nLinux kernel through 4.10.15 allows attackers to cause a denial of service\n(double free) or possibly have unspecified other impact by leveraging use\nof the accept system call (CVE-2017-8890).\n\nThe IPv6 fragmentation implementation in the Linux kernel through 4.11.1\ndoes not consider that the nexthdr field may be associated with an invalid\noption, which allows local users to cause a denial of service (out-of-bounds\nread and BUG) or possibly have unspecified other impact via crafted socket\nand send system calls (CVE-2017-9074).\n\nThe sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel\nthrough 4.11.1 mishandles inheritance, which allows local users to cause a\ndenial of service or possibly have unspecified other impact via crafted\nsystem calls, a related issue to CVE-2017-8890 (CVE-2017-9075).\n\nThe dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel\nthrough 4.11.1 mishandles inheritance, which allows local users to cause a\ndenial of service or possibly have unspecified other impact via crafted\nsystem calls, a related issue to CVE-2017-8890 (CVE-2017-9076).\n\nThe tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel\nthrough 4.11.1 mishandles inheritance, which allows local users to cause a\ndenial of service or possibly have unspecified other impact via crafted\nsystem calls, a related issue to CVE-2017-8890 (CVE-2017-9077).\n\nThe __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel\nthrough 4.11.3 is too late in checking whether an overwrite of an skb data\nstructure may occur, which allows local users to cause a denial of service\n(system crash) via crafted system calls (CVE-2017-9242).\n\nThe vmw_gb_surface_define_ioctl function (accessible via\nDRM_IOCTL_VMW_GB_SURFACE_CREATE) in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c\nin the Linux kernel through 4.11.4 defines a backup_handle variable but\ndoes not give it an initial value. If one attempts to create a GB surface,\nwith a previously allocated DMA buffer to be used as a backup buffer, the\nbackup_handle variable does not get written to and is then later returned\nto user space, allowing local users to obtain sensitive information from\nuninitialized kernel memory via a crafted ioctl call (CVE-2017-9605).\n\nA vulnerability was found in the Linux kernel's lp_setup() function where it\ndoesn't apply any bounds checking when passing \"lp=none\". This can result\ninto overflow of the parport_nr[] array. An attacker with control over kernel\ncommand line can overwrite kernel code and data with fixed (0xff) values\n(CVE-2017-1000363).\n\nA flaw was found in the way memory was being allocated on the stack for\nuser space binaries. If heap (or different memory region) and stack memory\nregions were adjacent to each other, an attacker could use this flaw to\njump over the stack guard gap, cause controlled memory corruption on process\nstack or the adjacent memory region, and thus increase their privileges on\nthe system. This is a kernel-side mitigation which increases the stack guard\ngap size from one page to 1 MiB to make successful exploitation of this\nissue more difficult (CVE-2017-1000364).\n\nThe Linux Kernel imposes a size restriction on the arguments and\nenvironmental strings passed through RLIMIT_STACK/RLIM_INFINITY(1/4 of\nthe size), but does not take the argument and environment pointers into\naccount, which allows attackers to bypass this limitation. This affects\nLinux Kernel versions 4.11.5 and earlier (CVE-2017-1000365).\n\nsound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a\ndata race in the ALSA /dev/snd/timer driver resulting in local users being\nable to read information belonging to other users, i.e., uninitialized\nmemory contents may be disclosed when a read and an ioctl happen at the\nsame time (CVE-2017-1000380).\n\nThe block interface response structure has some discontiguous fields.\nCertain backends populate the structure fields of an otherwise\nuninitialized instance of this structure on their stacks, leaking\ndata through the (internal or trailing) padding field. A malicious\nunprivileged guest may be able to obtain sensitive information from the\nhost or other guests (XSA-216).\n\nNOTE! The CVE-2017-1000364 and CVE-2017-1000365 issues are part of a set\nof issues known as Stack Clash. The fixes have components in both glibc\nand the kernel. The glibc fix will be included in a separate update\nadvisory (mga#20803).\n\nOther changes in this kernel:\n- add support for rtl8812au wireless (mga#21043)\n- enable support for SMB2 (mga#20886)\n\nFor other upstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2017-06-26T21:37:03Z","modified":"2026-04-16T06:25:17.549063954Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"MGASA-2017-0188","title":"Updated kernel-linus packages fixes critical security vulnerabilities","description":"This kernel-linus update is based on upstream 4.4.74 and fixes at least\nthe following security issues:\n\nThe ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel through\n4.11.1 mishandles reference counts, which allows local users to cause a\ndenial of service (use-after-free) or possibly have unspecified other\nimpact via a failed SIOCGIFADDR ioctl call for an IPX interface\n(CVE-2017-7487).\n\nThe inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the\nLinux kernel through 4.10.15 allows attackers to cause a denial of service\n(double free) or possibly have unspecified other impact by leveraging use\nof the accept system call (CVE-2017-8890).\n\nThe IPv6 fragmentation implementation in the Linux kernel through 4.11.1\ndoes not consider that the nexthdr field may be associated with an invalid\noption, which allows local users to cause a denial of service (out-of-bounds\nread and BUG) or possibly have unspecified other impact via crafted socket\nand send system calls (CVE-2017-9074).\n\nThe sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel\nthrough 4.11.1 mishandles inheritance, which allows local users to cause a\ndenial of service or possibly have unspecified other impact via crafted\nsystem calls, a related issue to CVE-2017-8890 (CVE-2017-9075).\n\nThe dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel\nthrough 4.11.1 mishandles inheritance, which allows local users to cause a\ndenial of service or possibly have unspecified other impact via crafted\nsystem calls, a related issue to CVE-2017-8890 (CVE-2017-9076).\n\nThe tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel\nthrough 4.11.1 mishandles inheritance, which allows local users to cause a\ndenial of service or possibly have unspecified other impact via crafted\nsystem calls, a related issue to CVE-2017-8890 (CVE-2017-9077).\n\nThe __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel\nthrough 4.11.3 is too late in checking whether an overwrite of an skb data\nstructure may occur, which allows local users to cause a denial of service\n(system crash) via crafted system calls (CVE-2017-9242).\n\nThe vmw_gb_surface_define_ioctl function (accessible via\nDRM_IOCTL_VMW_GB_SURFACE_CREATE) in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c\nin the Linux kernel through 4.11.4 defines a backup_handle variable but\ndoes not give it an initial value. If one attempts to create a GB surface,\nwith a previously allocated DMA buffer to be used as a backup buffer, the\nbackup_handle variable does not get written to and is then later returned\nto user space, allowing local users to obtain sensitive information from\nuninitialized kernel memory via a crafted ioctl call (CVE-2017-9605).\n\nA vulnerability was found in the Linux kernel's lp_setup() function where it\ndoesn't apply any bounds checking when passing \"lp=none\". This can result\ninto overflow of the parport_nr[] array. An attacker with control over kernel\ncommand line can overwrite kernel code and data with fixed (0xff) values\n(CVE-2017-1000363).\n\nA flaw was found in the way memory was being allocated on the stack for\nuser space binaries. If heap (or different memory region) and stack memory\nregions were adjacent to each other, an attacker could use this flaw to\njump over the stack guard gap, cause controlled memory corruption on process\nstack or the adjacent memory region, and thus increase their privileges on\nthe system. This is a kernel-side mitigation which increases the stack guard\ngap size from one page to 1 MiB to make successful exploitation of this\nissue more difficult (CVE-2017-1000364).\n\nThe Linux Kernel imposes a size restriction on the arguments and\nenvironmental strings passed through RLIMIT_STACK/RLIM_INFINITY(1/4 of\nthe size), but does not take the argument and environment pointers into\naccount, which allows attackers to bypass this limitation. This affects\nLinux Kernel versions 4.11.5 and earlier (CVE-2017-1000365).\n\nsound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a\ndata race in the ALSA /dev/snd/timer driver resulting in local users being\nable to read information belonging to other users, i.e., uninitialized\nmemory contents may be disclosed when a read and an ioctl happen at the\nsame time (CVE-2017-1000380).\n\nNOTE! The CVE-2017-1000364 and CVE-2017-1000365 issues are part of a set\nof issues known as Stack Clash. The fixes have components in both glibc\nand the kernel. The glibc fix will be included in a separate update\nadvisory (mga#20803).\n\nOther changes in this kernel:\n- enable support for SMB2 (mga#20886)\n\nFor other upstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2017-06-26T21:37:03Z","modified":"2026-04-16T06:24:14.11750533Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"USN-3360-1","title":"linux vulnerabilities","description":"It was discovered that the Linux kernel did not properly initialize a Wake-\non-Lan data structure. A local attacker could use this to expose sensitive\ninformation (kernel memory). (CVE-2014-9900)\n\nIt was discovered that the Linux kernel did not properly restrict access to\n/proc/iomem. A local attacker could use this to expose sensitive\ninformation. (CVE-2015-8944)\n\nIt was discovered that a use-after-free vulnerability existed in the\nperformance events and counters subsystem of the Linux kernel for ARM64. A\nlocal attacker could use this to cause a denial of service (system crash)\nor possibly execute arbitrary code. (CVE-2015-8955)\n\nIt was discovered that the SCSI generic (sg) driver in the Linux kernel\ncontained a double-free vulnerability. A local attacker could use this to\ncause a denial of service (system crash). (CVE-2015-8962)\n\nSasha Levin discovered that a race condition existed in the performance\nevents and counters subsystem of the Linux kernel when handling CPU unplug\nevents. A local attacker could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2015-8963)\n\nTilman Schmidt and Sasha Levin discovered a use-after-free condition in the\nTTY implementation in the Linux kernel. A local attacker could use this to\nexpose sensitive information (kernel memory). (CVE-2015-8964)\n\nIt was discovered that the fcntl64() system call in the Linux kernel did\nnot properly set memory limits when returning on 32-bit ARM processors. A\nlocal attacker could use this to gain administrative privileges.\n(CVE-2015-8966)\n\nIt was discovered that the system call table for ARM 64-bit processors in\nthe Linux kernel was not write-protected. An attacker could use this in\nconjunction with another kernel vulnerability to execute arbitrary code.\n(CVE-2015-8967)\n\nIt was discovered that the generic SCSI block layer in the Linux kernel did\nnot properly restrict write operations in certain situations. A local\nattacker could use this to cause a denial of service (system crash) or\npossibly gain administrative privileges. (CVE-2016-10088)\n\nAlexander Potapenko discovered a race condition in the Advanced Linux Sound\nArchitecture (ALSA) subsystem in the Linux kernel. A local attacker could\nuse this to expose sensitive information (kernel memory).\n(CVE-2017-1000380)\n\nLi Qiang discovered that the DRM driver for VMware Virtual GPUs in the\nLinux kernel did not properly validate some ioctl arguments. A local\nattacker could use this to cause a denial of service (system crash).\n(CVE-2017-7346)\n\nTuomas Haanpää and Ari Kauppi discovered that the NFSv2 and NFSv3 server\nimplementations in the Linux kernel did not properly check for the end of\nbuffer. A remote attacker could use this to craft requests that cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-7895)\n\nIt was discovered that an integer underflow existed in the Edgeport USB\nSerial Converter device driver of the Linux kernel. An attacker with\nphysical access could use this to expose sensitive information (kernel\nmemory). (CVE-2017-8924)\n\nIt was discovered that the USB ZyXEL omni.net LCD PLUS driver in the Linux\nkernel did not properly perform reference counting. A local attacker could\nuse this to cause a denial of service (tty exhaustion). (CVE-2017-8925)\n\nMurray McAllister discovered that the DRM driver for VMware Virtual GPUs in\nthe Linux kernel did not properly initialize memory. A local attacker could\nuse this to expose sensitive information (kernel memory). (CVE-2017-9605)\n","status":"published","published":"2017-07-21T08:12:39Z","modified":"2026-04-22T09:36:29.846281Z","updated_at":"2026-11-02T16:58:13.496563Z"},{"id":"USN-3364-1","title":"linux, linux-raspi2, linux-snapdragon vulnerabilities","description":"It was discovered that the Linux kernel did not properly initialize a Wake-\non-Lan data structure. A local attacker could use this to expose sensitive\ninformation (kernel memory). (CVE-2014-9900)\n\nIt was discovered that the Linux kernel did not properly restrict access to\n/proc/iomem. A local attacker could use this to expose sensitive\ninformation. (CVE-2015-8944)\n\nAlexander Potapenko discovered a race condition in the Advanced Linux Sound\nArchitecture (ALSA) subsystem in the Linux kernel. A local attacker could\nuse this to expose sensitive information (kernel memory).\n(CVE-2017-1000380)\n\nLi Qiang discovered that the DRM driver for VMware Virtual GPUs in the\nLinux kernel did not properly validate some ioctl arguments. A local\nattacker could use this to cause a denial of service (system crash).\n(CVE-2017-7346)\n\nJann Horn discovered that bpf in Linux kernel does not restrict the output\nof the print_bpf_insn function. A local attacker could use this to obtain\nsensitive address information. (CVE-2017-9150)\n\nMurray McAllister discovered that the DRM driver for VMware Virtual GPUs in\nthe Linux kernel did not properly initialize memory. A local attacker could\nuse this to expose sensitive information (kernel memory). (CVE-2017-9605)\n","status":"published","published":"2017-07-24T22:30:39Z","modified":"2026-04-22T09:37:00.230981Z","updated_at":"2026-11-02T16:58:13.496563Z"},{"id":"USN-3364-2","title":"linux-lts-xenial vulnerabilities","description":"USN-3364-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04\nLTS. This update provides the corresponding updates for the Linux\nHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu\n14.04 LTS.\n\nIt was discovered that the Linux kernel did not properly initialize a Wake-\non-Lan data structure. A local attacker could use this to expose sensitive\ninformation (kernel memory). (CVE-2014-9900)\n\nIt was discovered that the Linux kernel did not properly restrict access to\n/proc/iomem. A local attacker could use this to expose sensitive\ninformation. (CVE-2015-8944)\n\nAlexander Potapenko discovered a race condition in the Advanced Linux Sound\nArchitecture (ALSA) subsystem in the Linux kernel. A local attacker could\nuse this to expose sensitive information (kernel memory).\n(CVE-2017-1000380)\n\nLi Qiang discovered that the DRM driver for VMware Virtual GPUs in the\nLinux kernel did not properly validate some ioctl arguments. A local\nattacker could use this to cause a denial of service (system crash).\n(CVE-2017-7346)\n\nJann Horn discovered that bpf in Linux kernel does not restrict the output\nof the print_bpf_insn function. A local attacker could use this to obtain\nsensitive address information. (CVE-2017-9150)\n\nMurray McAllister discovered that the DRM driver for VMware Virtual GPUs in\nthe Linux kernel did not properly initialize memory. A local attacker could\nuse this to expose sensitive information (kernel memory). (CVE-2017-9605)\n","status":"published","published":"2017-07-24T23:16:25Z","modified":"2026-02-10T04:41:10Z","updated_at":"2026-11-02T16:58:13.496563Z"},{"id":"USN-3364-3","title":"linux-aws, linux-gke vulnerabilities","description":"It was discovered that the Linux kernel did not properly initialize a Wake-\non-Lan data structure. A local attacker could use this to expose sensitive\ninformation (kernel memory). (CVE-2014-9900)\n\nIt was discovered that the Linux kernel did not properly restrict access to\n/proc/iomem. A local attacker could use this to expose sensitive\ninformation. (CVE-2015-8944)\n\nAlexander Potapenko discovered a race condition in the Advanced Linux Sound\nArchitecture (ALSA) subsystem in the Linux kernel. A local attacker could\nuse this to expose sensitive information (kernel memory).\n(CVE-2017-1000380)\n\nLi Qiang discovered that the DRM driver for VMware Virtual GPUs in the\nLinux kernel did not properly validate some ioctl arguments. A local\nattacker could use this to cause a denial of service (system crash).\n(CVE-2017-7346)\n\nJann Horn discovered that bpf in Linux kernel does not restrict the output\nof the print_bpf_insn function. A local attacker could use this to obtain\nsensitive address information. (CVE-2017-9150)\n\nMurray McAllister discovered that the DRM driver for VMware Virtual GPUs in\nthe Linux kernel did not properly initialize memory. A local attacker could\nuse this to expose sensitive information (kernel memory). (CVE-2017-9605)\n","status":"published","published":"2017-07-25T23:09:15Z","modified":"2026-02-10T04:41:10Z","updated_at":"2026-11-02T16:58:13.496563Z"},{"id":"USN-3371-1","title":"linux-hwe vulnerabilities","description":"It was discovered that the Linux kernel did not properly initialize a Wake-\non-Lan data structure. A local attacker could use this to expose sensitive\ninformation (kernel memory). (CVE-2014-9900)\n\nAlexander Potapenko discovered a race condition in the Advanced Linux Sound\nArchitecture (ALSA) subsystem in the Linux kernel. A local attacker could\nuse this to expose sensitive information (kernel memory).\n(CVE-2017-1000380)\n\nLi Qiang discovered that the DRM driver for VMware Virtual GPUs in the\nLinux kernel did not properly validate some ioctl arguments. A local\nattacker could use this to cause a denial of service (system crash).\n(CVE-2017-7346)\n\nMurray McAllister discovered that the DRM driver for VMware Virtual GPUs in\nthe Linux kernel did not properly initialize memory. A local attacker could\nuse this to expose sensitive information (kernel memory). (CVE-2017-9605)\n","status":"published","published":"2017-07-28T17:35:56Z","modified":"2026-02-10T04:41:11Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}