Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 9 Oct 2017 11:12:08 +0200
From: Alexander Potapenko <>
Subject: CVE-2017-14991 in the Linux Kernel: local infoleak via an
 SG_GET_REQUEST_TABLE ioctl call for /dev/sg0


Kernel commit 109bade9c625c89bb5ea753aaa1a0a97e6fbb548 has introduced
an infoleak which manifests when the SG_GET_REQUEST_TABLE ioctl is
called for /dev/sg0 (see the attached repro).
The bug allows local users to obtain sensitive information from
uninitialized kernel heap-memory locations. Linux kernels before
4.13.4 are affected.
The bug has been found with syzkaller and KMSAN, upstream fix is here:

Alexander Potapenko
Software Engineer

Google Germany GmbH
Erika-Mann-Straße, 33
80636 München

Geschäftsführer: Paul Manicle, Halimah DeLaine Prado
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg

View attachment "sg_ioctl.c" of type "text/x-csrc" (1683 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.