Medium severity5.5NVD Advisory· Published Nov 27, 2017· Updated Jun 17, 2026

CVE-2017-16994

Description

The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Linux/Kernel2 versions
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: <4.14.2
- (no CPE)range: <4.14.2
osv-coords35 versions
pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2012%20SP2 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2012%20SP3 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20Raspberry%20Pi%2012%20SP2 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012%20SP2 pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012%20SP3 pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP2 pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP2 pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/kernel-rt_debug&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2012%20SP2 pkg:rpm/suse/kernel-rt&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2012%20SP2 pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2 pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2 pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20Raspberry%20Pi%2012%20SP2 pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/kernel-source-rt&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2012%20SP2 pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2 pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2 pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20Raspberry%20Pi%2012%20SP2 pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/kernel-syms-rt&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2012%20SP2 pkg:rpm/suse/kgraft-patch-SLE12-SP2_Update_16&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2012 pkg:rpm/suse/kgraft-patch-SLE12-SP3_Update_6&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2012%20SP3
< 4.4.103-92.53.1+ 34 more
- (no CPE)range: < 4.4.103-92.53.1
- (no CPE)range: < 4.4.103-6.33.1
- (no CPE)range: < 4.4.103-92.53.1
- (no CPE)range: < 4.4.103-6.33.1
- (no CPE)range: < 4.4.103-92.53.1
- (no CPE)range: < 4.4.103-6.33.1
- (no CPE)range: < 4.4.103-92.53.1
- (no CPE)range: < 4.4.103-92.53.1
- (no CPE)range: < 4.4.103-6.33.1
- (no CPE)range: < 4.4.103-92.53.1
- (no CPE)range: < 4.4.103-6.33.1
- (no CPE)range: < 4.4.103-92.53.1
- (no CPE)range: < 4.4.103-6.33.1
- (no CPE)range: < 4.4.103-92.53.1
- (no CPE)range: < 4.4.103-6.33.1
- (no CPE)range: < 4.4.104-24.1
- (no CPE)range: < 4.4.104-24.1
- (no CPE)range: < 4.4.103-92.53.1
- (no CPE)range: < 4.4.103-6.33.1
- (no CPE)range: < 4.4.103-92.53.1
- (no CPE)range: < 4.4.103-6.33.1
- (no CPE)range: < 4.4.103-92.53.1
- (no CPE)range: < 4.4.103-92.53.1
- (no CPE)range: < 4.4.103-6.33.1
- (no CPE)range: < 4.4.104-24.1
- (no CPE)range: < 4.4.103-92.53.1
- (no CPE)range: < 4.4.103-6.33.1
- (no CPE)range: < 4.4.103-92.53.1
- (no CPE)range: < 4.4.103-6.33.1
- (no CPE)range: < 4.4.103-92.53.1
- (no CPE)range: < 4.4.103-92.53.1
- (no CPE)range: < 4.4.103-6.33.1
- (no CPE)range: < 4.4.104-24.1
- (no CPE)range: < 1-3.3.1
- (no CPE)range: < 1-4.3.1

Patches

Vulnerability mechanics

References

git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/nvdPatch
github.com/torvalds/linux/commit/373c4557d2aa362702c4c2d41288fb1e54990b7cnvdPatch
bugs.chromium.org/p/project-zero/issues/detailnvdExploitIssue TrackingPatch
www.exploit-db.com/exploits/43178/nvdExploitThird Party AdvisoryVDB Entry
www.securityfocus.com/bid/101969nvdThird Party AdvisoryVDB Entry
www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.2nvdRelease Notes
access.redhat.com/errata/RHSA-2018:0502nvd
usn.ubuntu.com/3617-1/nvd
usn.ubuntu.com/3617-2/nvd
usn.ubuntu.com/3617-3/nvd
usn.ubuntu.com/3619-1/nvd
usn.ubuntu.com/3619-2/nvd
usn.ubuntu.com/3632-1/nvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.002
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000