CVE-2017-1000363 | Date: (C)2017-07-18 (M)2024-04-19 |
Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missing bounds check, and the fact that parport_ptr integer is static, a 'secure boot' kernel command line adversary (can happen due to bootloader vulns, e.g. Google Nexus 6's CVE-2016-10277, where due to a vulnerability the adversary has partial control over the command line) can overflow the parport_nr array in the following code, by appending many (>LP_NO) 'lp=none' arguments to the command line.
CVSS Score and Metrics +CVSS Score and Metrics -CVSS V3 Severity: | CVSS V2 Severity: |
CVSS Score : 7.8 | CVSS Score : 7.2 |
Exploit Score: 1.8 | Exploit Score: 3.9 |
Impact Score: 5.9 | Impact Score: 10.0 |
|
CVSS V3 Metrics: | CVSS V2 Metrics: |
Attack Vector: LOCAL | Access Vector: LOCAL |
Attack Complexity: LOW | Access Complexity: LOW |
Privileges Required: LOW | Authentication: NONE |
User Interaction: NONE | Confidentiality: COMPLETE |
Scope: UNCHANGED | Integrity: COMPLETE |
Confidentiality: HIGH | Availability: COMPLETE |
Integrity: HIGH | |
Availability: HIGH | |
| |