The acpinsterminate() function in drivers/acpi/acpica/nsutils.c in the Linux kernel before 4.12 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-11472.json"
[
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"160257158745435353444681114242600397424",
"320959413685728090059856194472559137597",
"76361150319743885756544570307652245157",
"284726580683836558720567823032915986841",
"267641676633280549390901660202536192731",
"294505264912809659452105036729270584009",
"84176385676803159331887798288825408832",
"212489078959866372226822015407057503279",
"272774526833429879660925144662036816946",
"308919357823123397274884728904466857182",
"70846104480496930025809586151350873735",
"165826952574719814223189434891773402755",
"166069281658330524644980986202049236015",
"338756039348537644892782472528637813825",
"268501692075986542020291961468115811574",
"195621367342947881590622163784840881316",
"126655772050172006482347730425627790177",
"93962209129926248655610971717537872704"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2017-11472-2c9022ad",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@3b2d69114fefa474fca542e51119036dceb4aa6f",
"target": {
"file": "drivers/acpi/acpica/nsutils.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 536.0,
"function_hash": "259706199995133269485049297551902777685"
},
"signature_type": "Function",
"id": "CVE-2017-11472-cb9561b1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@3b2d69114fefa474fca542e51119036dceb4aa6f",
"target": {
"function": "acpi_ns_terminate",
"file": "drivers/acpi/acpica/nsutils.c"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-11472.json"
[
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 528.0,
"function_hash": "174748589664883033104654405558319489936"
},
"signature_type": "Function",
"id": "CVE-2017-11472-681eaa61",
"source": "https://github.com/acpica/acpica/commit/a23325b2e583556eae88ed3f764e457786bf4df6",
"target": {
"function": "AcpiNsTerminate",
"file": "source/components/namespace/nsutils.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"111405520421529477343576328790613805502",
"24165035841707509061669901996127841320",
"70845252819591974147340375654798826609",
"146655471382523271585466297713909395142",
"9320983958298004335404137929777364676",
"298938025842508986136143020996200866888",
"48420313107118061346757742973504471627",
"139471878566299589174492027523446336207",
"285603526139145948303817236265889518613",
"198755297806838637971463401595102329120",
"200332067128688483534573320932547242625",
"113874925040596747941081065155345107076",
"217684558569684052318914307065688936733",
"129208954908763194157028401687077062693",
"319367110924165512350946395024046890603",
"126569250251023627899466679699844270522",
"195372794951861706375666809942622637781",
"15421412188556333618425282586583814055",
"335565038018466964014168938245667826107"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2017-11472-b15f5656",
"source": "https://github.com/acpica/acpica/commit/a23325b2e583556eae88ed3f764e457786bf4df6",
"target": {
"file": "source/components/namespace/nsutils.c"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-11472.json"
[
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 536.0,
"function_hash": "259706199995133269485049297551902777685"
},
"signature_type": "Function",
"id": "CVE-2017-11472-440ef3a6",
"source": "https://github.com/torvalds/linux/commit/3b2d69114fefa474fca542e51119036dceb4aa6f",
"target": {
"function": "acpi_ns_terminate",
"file": "drivers/acpi/acpica/nsutils.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"160257158745435353444681114242600397424",
"320959413685728090059856194472559137597",
"76361150319743885756544570307652245157",
"284726580683836558720567823032915986841",
"267641676633280549390901660202536192731",
"294505264912809659452105036729270584009",
"84176385676803159331887798288825408832",
"212489078959866372226822015407057503279",
"272774526833429879660925144662036816946",
"308919357823123397274884728904466857182",
"70846104480496930025809586151350873735",
"165826952574719814223189434891773402755",
"166069281658330524644980986202049236015",
"338756039348537644892782472528637813825",
"268501692075986542020291961468115811574",
"195621367342947881590622163784840881316",
"126655772050172006482347730425627790177",
"93962209129926248655610971717537872704"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2017-11472-cf24d411",
"source": "https://github.com/torvalds/linux/commit/3b2d69114fefa474fca542e51119036dceb4aa6f",
"target": {
"file": "drivers/acpi/acpica/nsutils.c"
}
}
]