Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors.

Metrics

No CVSS v4.0

No CVSS v3.1

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00085.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Google
  • Android
Redhat
  • Enterprise Linux
  • Rhel Eus
  • Rhel Extras Rt

Configuration 1 [-]

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 6
kernel-0:2.6.32-754.3.5.el6 cpe:/o:redhat:enterprise_linux:6 RHSA-2018:2390 2018-08-14T00:00:00Z
Red Hat Enterprise Linux 7
kernel-rt-0:3.10.0-957.rt56.910.el7 cpe:/a:redhat:rhel_extras_rt:7 RHSA-2018:3096 2018-10-30T00:00:00Z
kernel-0:3.10.0-957.el7 cpe:/o:redhat:enterprise_linux:7 RHSA-2018:3083 2018-10-30T00:00:00Z
Red Hat Enterprise Linux 7.5 Extended Update Support
kernel-0:3.10.0-862.46.1.el7 cpe:/o:redhat:rhel_eus:7.5 RHSA-2020:0036 2020-01-07T00:00:00Z

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://lists.alioth.debian.org/pipermail/secure-testing-commits/2017-December/059967.html cve-icon cve-icon
http://www.securityfocus.com/bid/102329 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2018:2390 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2018:3083 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2018:3096 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2020:0036 cve-icon cve-icon
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=362bca57f5d78220f8b5907b875961af9436e229 cve-icon cve-icon
https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2017-0861 cve-icon
https://security-tracker.debian.org/tracker/CVE-2017-0861 cve-icon cve-icon
https://source.android.com/security/bulletin/pixel/2017-11-01 cve-icon cve-icon
https://usn.ubuntu.com/3583-1/ cve-icon cve-icon
https://usn.ubuntu.com/3583-2/ cve-icon cve-icon
https://usn.ubuntu.com/3617-1/ cve-icon cve-icon
https://usn.ubuntu.com/3617-2/ cve-icon cve-icon
https://usn.ubuntu.com/3617-3/ cve-icon cve-icon
https://usn.ubuntu.com/3619-1/ cve-icon cve-icon
https://usn.ubuntu.com/3619-2/ cve-icon cve-icon
https://usn.ubuntu.com/3632-1/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2017-0861 cve-icon
https://www.debian.org/security/2018/dsa-4187 cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2020.html cve-icon cve-icon
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html cve-icon cve-icon
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: google_android

Published:

Updated: 2024-09-16T19:09:26.250Z

Reserved: 2016-11-29T00:00:00

Link: CVE-2017-0861

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2017-11-16T23:29:01.320

Modified: 2025-04-20T01:37:25.860

Link: CVE-2017-0861

cve-icon Redhat

Severity : Moderate

Publid Date: 2017-12-05T00:00:00Z

Links: CVE-2017-0861 - Bugzilla

cve-icon OpenCVE Enrichment

No data.