CVE-2017-1000255

On Linux running on PowerPC hardware (Power8 or later) a user process can craft a signal frame and then do a sigreturn so that the kernel will take an exception (interrupt), and use the r1 value *from the signal frame* as the kernel stack pointer. As part of the exception entry the content of the signal frame is written to the kernel stack, allowing an attacker to overwrite arbitrary locations with arbitrary values. The exception handling does produce an oops, and a panic if panic_on_oops=1, but only after kernel memory has been over written. This flaw was introduced in commit: "5d176f751ee3 (powerpc: tm: Enable transactional memory (TM) lazily for userspace)" which was merged upstream into v4.9-rc1. Please note that kernels built with CONFIG_PPC_TRANSACTIONAL_MEM=n are not vulnerable.

From the Ubuntu Security Team

It was discovered that on the PowerPC architecture, the kernel did not properly sanitize the signal stack when handling sigreturn(). A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
linux	17.10 artful	Fixed 4.13.0-17.20
	17.04 zesty	Fixed 4.10.0-37.41
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected
linux-armadaxp	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-aws	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected
linux-azure	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected
linux-euclid	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-flo	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Ignored abandoned
	14.04 LTS trusty	Not in release
linux-gcp	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-gke	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-goldfish	17.10 artful	Not in release
	17.04 zesty	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-grouper	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-hwe	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Fixed 4.10.0-37.41~16.04.1
	14.04 LTS trusty	Not in release
linux-hwe-edge	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Fixed 4.10.0-37.41~16.04.1
	14.04 LTS trusty	Not in release
linux-kvm	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-linaro-omap	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-linaro-shared	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-linaro-vexpress	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-lts-quantal	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-lts-raring	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-lts-saucy	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-lts-trusty	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-lts-utopic	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-lts-vivid	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-lts-wily	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-lts-xenial	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not affected
linux-maguro	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-mako	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Ignored abandoned
	14.04 LTS trusty	Not in release
linux-manta	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-oem	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-qcm-msm	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
linux-raspi2	17.10 artful	Not affected
	17.04 zesty	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-snapdragon	17.10 artful	Not affected
	17.04 zesty	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
linux-ti-omap4	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release

Notes

sbeattie

introduced in v4.9 cycle, PPC on power8 only

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
linux	Introduced by 5d176f7, fixed by 265e60a Introduced by 5d176f7, fixed by 044215d

Severity score breakdown

Parameter	Value
Base score	5.5 · Medium
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	High
Availability impact	None
Vector	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

Related Ubuntu Security Notices (USN)

USN-3487-1
Linux kernel vulnerabilities
21 November 2017

USN-3443-2
Linux kernel (HWE) vulnerabilities
10 October 2017

USN-3443-1
Linux kernel vulnerabilities
10 October 2017

Other references

https://www.cve.org/CVERecord?id=CVE-2017-1000255