Critical Vulnerability Information Vulnerability ID: Bug 1416437 (CVE-2017-5577) Vulnerability Description: kernel: vc4: Heap-buffer overflow due to failing checks Report Date: 2017-01-25 13:34 UTC Status: CLOSED NOTABUG Product: Security Response Component: vulnerability Priority: Low Severity: Low Operating System: Linux Affected Versions: Not specified Hardware: All Reporter: Andrej Nemec Detailed Description The function in in the VideoCore DRM driver in the Linux kernel before 4.9.7 does not set an value upon certain overflow detections, which allows local users to cause a denial of service (incorrect pointer dereference and OOPS) via inconsistent size values in a ioctl call. Reference Links http://seclists.org/oss-sec/2017/q1/165 https://lkml.org/lkml/2017/1/17/759 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6b8ac63847bc2f958dd93c09edc941a0118992d9 Affected Scope All Fedora Versions: bug 1416439 Unaffected Products: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and MRG-2 as the code with the flaw is not present in the products listed.