CVE-2017-14340

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The XFS_IS_REALTIME_INODE macro in fs/xfs/xfs_linux.h in the Linux kernel before 4.13.2 does not verify that a filesystem has a realtime device, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via vectors related to setting an RHINHERIT flag on a directory.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b31ff3cdf540110da4572e3e29bd172087af65ccIssue Tracking, Patch, Third Party Advisory
http://seclists.org/oss-sec/2017/q3/436Mailing List, Mitigation, Patch, Third Party Advisory
http://www.debian.org/security/2017/dsa-3981
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.2Release Notes, Vendor Advisory
http://www.securityfocus.com/bid/100851Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:2918
https://bugzilla.redhat.com/show_bug.cgi?id=1491344Issue Tracking, Patch, Third Party Advisory
https://github.com/torvalds/linux/commit/b31ff3cdf540110da4572e3e29bd172087af65ccIssue Tracking, Patch, Third Party Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b31ff3cdf540110da4572e3e29bd172087af65ccIssue Tracking, Patch, Third Party Advisory
http://seclists.org/oss-sec/2017/q3/436Mailing List, Mitigation, Patch, Third Party Advisory
http://www.debian.org/security/2017/dsa-3981
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.2Release Notes, Vendor Advisory
http://www.securityfocus.com/bid/100851Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:2918
https://bugzilla.redhat.com/show_bug.cgi?id=1491344Issue Tracking, Patch, Third Party Advisory
https://github.com/torvalds/linux/commit/b31ff3cdf540110da4572e3e29bd172087af65ccIssue Tracking, Patch, Third Party Advisory

Timeline

Published: Sep 15, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-143416.5ImageMagick 7.0.6-6 has a large loop vulnerability in ReadWPGImage in coders/wpg.c, causing CPU exhaustion via a crafted wpg image file.CVE-2017-143426.5ImageMagick 7.0.6-6 has a memory exhaustion vulnerability in ReadWPGImage in coders/wpg.c via a crafted wpg image file.CVE-2017-143436.5ImageMagick 7.0.6-6 has a memory leak vulnerability in ReadXCFImage in coders/xcf.c via a crafted xcf image file.CVE-2017-143447.8This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. An attacker must first obtain the ab CVE-2017-143459.8SQL Injection exists in tianchoy/blog through 2017-09-12 via the id parameter to view.php.CVE-2017-143469.8upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, CVE-2017-143476.1NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to fun.php in a delete action.CVE-2017-143488.8LibRaw before 0.18.4 has a heap-based Buffer Overflow in the processCanonCameraInfo function via a crafted file.CVE-2017-143499.8An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x, allows read-only accounts to view all SiteScope interface CVE-2017-143509.8A potential security vulnerability has been identified in HPE Application Performance Management (BSM) Platform versions 9.26, 9.30, 9.40. T CVE-2017-143519.8A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.23. CVE-2017-143526.1A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.23.