CVE-2017-2647

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain match field, related to the keyring_search_iterator function in keyring.c.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-476

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-26485.6It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle at CVE-2017-26498.1It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Director CVE-2017-26508.5It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM comm CVE-2017-26513.7jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically CVE-2017-26528.8It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provi CVE-2017-26536.5A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST reques CVE-2017-26545.3jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dy CVE-2017-26586.5It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Se CVE-2017-26597.5It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is CVE-2017-26616.1ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field w CVE-2017-26624.3A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filte CVE-2017-26637.8It was found that subscription-manager's DBus interface before 1.19.4 let unprivileged user access the com.redhat.RHSM1.Facts.GetFacts and c