CVE-2017-18221:Linux kernel vulnerability in __munlock_pagevec function allows local denial of service through NR_MLOCK accounting corruption.

splash
Back

Description Preview

CVE-2017-18221 affects the Linux kernel's memory locking mechanism. A vulnerability in the __munlock_pagevec function in mm/mlock.c in Linux kernel versions before 4.11.4 allows local users to cause a denial of service condition. The issue stems from improper input validation (CWE-20) where attackers can corrupt NR_MLOCK accounting through crafted use of mlockall and munlockall system calls. This corruption can lead to system instability or crashes, affecting the availability of the system.

Overview

This vulnerability affects the memory management subsystem of the Linux kernel, specifically the mechanism that handles locking pages in memory. The __munlock_pagevec function contains a flaw in how it tracks and accounts for locked memory pages. By manipulating the mlockall and munlockall system calls in a specific sequence, an attacker with local access can cause corruption in the NR_MLOCK counter, which tracks the number of locked pages. This corruption can lead to kernel instability, resource exhaustion, or complete system crashes. The vulnerability is particularly concerning in multi-user environments where local users should not be able to affect system stability.

Remediation

To address this vulnerability, system administrators should:

  1. Update the Linux kernel to version 4.11.4 or later which contains the fix.
  2. If running Ubuntu, apply the security updates referenced in USN-3655-1 and USN-3655-2.
  3. If immediate patching is not possible, consider implementing additional access controls to restrict who can use the mlockall/munlockall system calls.
  4. Monitor system logs for unusual memory-related errors or crashes that might indicate exploitation attempts.
  5. For systems where kernel updates are challenging, apply the specific patch referenced in the kernel commit (70feee0e1ef331b22cc51f383d532a0d043fbdcc).

References

  1. Linux Kernel Patch: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=70feee0e1ef331b22cc51f383d532a0d043fbdcc
  2. GitHub Mirror of Patch: https://github.com/torvalds/linux/commit/70feee0e1ef331b22cc51f383d532a0d043fbdcc
  3. Security Focus BID: http://www.securityfocus.com/bid/103321
  4. Ubuntu Security Notice USN-3655-1: https://usn.ubuntu.com/3655-1/
  5. Ubuntu Security Notice USN-3655-2: https://usn.ubuntu.com/3655-2/
  6. Linux Kernel 4.11.4 Changelog: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.4

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Manufacturing
    Manufacturing
  2. Health Care & Social Assistance
    Health Care & Social Assistance
  3. Public Administration
    Public Administration
  4. Educational Services
    Educational Services
  5. Finance and Insurance
    Finance and Insurance
  6. Retail Trade
    Retail Trade
  7. Utilities
    Utilities
  8. Other Services (except Public Administration)
    Other Services (except Public Administration)
  9. Professional, Scientific, & Technical Services
    Professional, Scientific, & Technical Services
  10. Transportation & Warehousing
    Transportation & Warehousing
  11. Management of Companies & Enterprises
    Management of Companies & Enterprises
  12. Arts, Entertainment & Recreation
    Arts, Entertainment & Recreation
  13. Construction
    Construction
  14. Information
    Information
  15. Real Estate Rental & Leasing
    Real Estate Rental & Leasing
  16. Wholesale Trade
    Wholesale Trade
  17. Accommodation & Food Services
    Accommodation & Food Services
  18. Administrative, Support, Waste Management & Remediation Services
    Administrative, Support, Waste Management & Remediation Services
  19. Agriculture, Forestry Fishing & Hunting
    Agriculture, Forestry Fishing & Hunting
  20. Mining
    Mining

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background
Armis Vulnerability Intelligence Database