CVE-2017-1000363

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missing bounds check, and the fact that parport_ptr integer is static, a 'secure boot' kernel command line adversary (can happen due to bootloader vulns, e.g. Google Nexus 6's CVE-2016-10277, where due to a vulnerability the adversary has partial control over the command line) can overflow the parport_nr array in the following code, by appending many (>LP_NO) 'lp=none' arguments to the command line.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2017/dsa-3945Third Party Advisory
http://www.securityfocus.com/bid/98651Third Party Advisory, VDB Entry
https://alephsecurity.com/vulns/aleph-2017023Third Party Advisory
http://www.debian.org/security/2017/dsa-3945Third Party Advisory
http://www.securityfocus.com/bid/98651Third Party Advisory, VDB Entry
https://alephsecurity.com/vulns/aleph-2017023Third Party Advisory

Timeline

Published: Jul 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10003647.4An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can b CVE-2017-10003657.8The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the CVE-2017-10003667.8glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, pot CVE-2017-10003676.4Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function r CVE-2017-10003688.2Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() functi CVE-2017-10003694.0Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issu CVE-2017-10003707.8The offset2lib patch as used in the Linux Kernel contains a vulnerability that allows a PIE binary to be execve()'ed with 1GB of arguments o CVE-2017-10003717.8The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1 Gigabyte of memory CVE-2017-10003729.8A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution u CVE-2017-10003736.5The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that cause CVE-2017-10003749.8A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution us CVE-2017-10003759.8NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attackers to more easily ma