CVE-2017-5538

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The kbase_dispatch function in arm/t7xx/r5p0/mali_kbase_core_linux.c in the GPU driver on Samsung devices with M(6.0) and N(7.0) software and Exynos AP chipsets allows attackers to have unspecified impact via unknown vectors, which trigger an out-of-bounds read, aka SVE-2016-6362.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://security.samsungmobile.com/smrupdate.html#SMR-JAN-2017Vendor Advisory
http://www.openwall.com/lists/oss-security/2017/01/19/3Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/01/20/2Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/95674Third Party Advisory, VDB Entry
http://security.samsungmobile.com/smrupdate.html#SMR-JAN-2017Vendor Advisory
http://www.openwall.com/lists/oss-security/2017/01/19/3Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/01/20/2Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/95674Third Party Advisory, VDB Entry

Timeline

Published: Mar 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-55399.1The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ..\/ t CVE-2017-55415.3Directory traversal vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to renam CVE-2017-55426.1Cross-site scripting (XSS) vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers t CVE-2017-55439.8includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serializ CVE-2017-55445.9An issue was discovered on FiberHome Fengine S5800 switches V210R240. An unauthorized attacker can access the device's SSH service, using a CVE-2017-55459.1The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process mem CVE-2017-55467.8The freelist-randomization feature in mm/slab.c in the Linux kernel 4.8.x and 4.9.x before 4.9.5 allows local users to cause a denial of ser CVE-2017-55477.8drivers/hid/hid-corsair.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local CVE-2017-55487.8drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows CVE-2017-55495.5The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5 places uninitialized heap-memory co CVE-2017-55505.5Off-by-one error in the pipe_advance function in lib/iov_iter.c in the Linux kernel before 4.9.5 allows local users to obtain sensitive info CVE-2017-55514.4The simple_set_acl function in fs/posix_acl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a t