Total vulnerabilities in the database
The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).
| Software | From | Fixed in |
|---|---|---|
| linux / linux_kernel | - | 4.14.8 |
| canonical / ubuntu_linux | 14.04 | 14.04.x |
| canonical / ubuntu_linux | 12.04 | 12.04.x |
| redhat / enterprise_linux_desktop | 7.0 | 7.0.x |
| redhat / enterprise_linux_server_aus | 7.2 | 7.2.x |
| redhat / enterprise_linux_workstation | 7.0 | 7.0.x |
| redhat / enterprise_linux_server_tus | 7.2 | 7.2.x |
| redhat / enterprise_linux_server | 7.0 | 7.0.x |
| redhat / enterprise_linux_server_tus | 7.3 | 7.3.x |
| redhat / enterprise_linux_server_aus | 7.3 | 7.3.x |
| redhat / enterprise_linux_server_aus | 7.4 | 7.4.x |
| redhat / enterprise_linux_server_eus | 7.3 | 7.3.x |
| redhat / enterprise_linux_server_tus | 7.4 | 7.4.x |
| redhat / enterprise_linux_server_eus | 7.5 | 7.5.x |
| redhat / mrg_realtime | 2.0 | 2.0.x |