In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. This could possibly lead to memory corruption and possible privilege escalation.
Version | Score | Severity | Vector String |
---|---|---|---|
3.0 | 7.1 | High | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
Product | Vendor | Version |
---|---|---|
kernel: | [UNKNOWN] | n/a |