CVE-2017-6280

Published: 6 March 2018

NVIDIA driver contains a possible out-of-bounds read vulnerability due to a leak which may lead to information disclosure. This issue is rated as moderate. Android: A-63851980.

From the Ubuntu security team

sbeattie> drivers/gpu/drm/nouveau/nvkm/core/ioctl.c::nvkm_ioctl() sbeattie> possibly fixed in bf81df9be28657eea4aca8c6ab4ed3e69f8a051c

Priority

CVSS 3 base score: 7.5

Status

Package	Release	Status
linux Launchpad, Ubuntu, Debian	artful	Not vulnerable (4.10.0-19.21)
	bionic	Not vulnerable (4.13.0-16.19)
	precise	Ignored (was needs-triage ESM criteria)
	trusty	Not vulnerable
	upstream	Released (4.3~rc1)
	xenial	Not vulnerable (4.3.0-1.10)
linux-armadaxp Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Does not exist
linux-aws Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Not vulnerable (4.15.0-1001.1)
	precise	Does not exist
	trusty	Not vulnerable (4.4.0-1002.2)
	upstream	Released (4.3~rc1)
	xenial	Not vulnerable (4.4.0-1001.10)
linux-azure Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Not vulnerable (4.15.0-1002.2)
	precise	Does not exist
	trusty	Not vulnerable (4.15.0-1023.24~14.04.1)
	upstream	Released (4.3~rc1)
	xenial	Not vulnerable (4.11.0-1009.9)
linux-euclid Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Ignored (was needs-triage ESM criteria)
linux-flo Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored [abandoned])
	upstream	Released (4.3~rc1)
	xenial	Ignored (abandoned)
linux-gcp Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Not vulnerable (4.15.0-1001.1)
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Not vulnerable (4.10.0-1004.4)
linux-gke Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Ignored (was needs-triage now end-of-life)
linux-goldfish Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored [abandoned])
	upstream	Released (4.3~rc1)
	xenial	Ignored (was needs-triage now end-of-life)
linux-grouper Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored [abandoned])
	upstream	Released (4.3~rc1)
	xenial	Does not exist
linux-hwe Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Not vulnerable
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Not vulnerable (4.8.0-36.36~16.04.1)
linux-hwe-edge Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Released (4.18.0-8.9~18.04.1)
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Not vulnerable (4.8.0-36.36~16.04.1)
linux-kvm Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Not vulnerable (4.15.0-1002.2)
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Not vulnerable (4.4.0-1004.9)
linux-linaro-omap Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Does not exist
linux-linaro-shared Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Does not exist
linux-linaro-vexpress Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Does not exist
linux-lts-quantal Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Ignored (end-of-life)
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Does not exist
linux-lts-raring Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Ignored (end-of-life)
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Does not exist
linux-lts-saucy Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Ignored (end-of-life)
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Does not exist
linux-lts-trusty Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Ignored (was needed ESM criteria)
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Does not exist
linux-lts-utopic Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored [out of standard support])
	upstream	Released (4.3~rc1)
	xenial	Does not exist
linux-lts-vivid Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored [was needs-triage now end-of-life])
	upstream	Released (4.3~rc1)
	xenial	Does not exist
linux-lts-wily Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored [out of standard support])
	upstream	Released (4.3~rc1)
	xenial	Does not exist
linux-lts-xenial Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist
	trusty	Not vulnerable (4.4.0-13.29~14.04.1)
	upstream	Released (4.3~rc1)
	xenial	Does not exist
linux-maguro Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored [abandoned])
	upstream	Released (4.3~rc1)
	xenial	Does not exist
linux-mako Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored [abandoned])
	upstream	Released (4.3~rc1)
	xenial	Ignored (abandoned)
linux-manta Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored [abandoned])
	upstream	Released (4.3~rc1)
	xenial	Does not exist
linux-oem Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Not vulnerable (4.15.0-1002.3)
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Not vulnerable (4.13.0-1008.9)
linux-qcm-msm Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Does not exist
linux-raspi2 Launchpad, Ubuntu, Debian	artful	Not vulnerable (4.10.0-1004.6)
	bionic	Not vulnerable (4.13.0-1005.5)
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Not vulnerable (4.3.0-1006.6)
linux-snapdragon Launchpad, Ubuntu, Debian	artful	Not vulnerable (4.4.0-1050.54)
	bionic	Not vulnerable
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Not vulnerable (4.4.0-1012.12)
linux-ti-omap4 Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (4.3~rc1)
	xenial	Does not exist

Notes

Author	Note
smb	cking found that the ioctl interface was added much later than the driver (8ec2a6ec6e229d67b19737f9b603eef478fa955d -> 3.17)

References

Bugs

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›