CVE-2017-1000363

Name of the Vulnerable Software and Affected Versions Linux (affected versions not specified)

Description The issue is caused by a missing bounds check in the Linux kernel, specifically in the drivers/char/lp.c file. This allows an adversary with partial control over the kernel command line, potentially due to bootloader vulnerabilities, to overflow the parport nr array by appending multiple 'lp=none' arguments. The vulnerability can be exploited to cause a denial of service.

Recommendations For Linux, consider disabling the lp setup() function as a temporary workaround until a patch is available. Restrict access to the parport nr array to minimize the risk of exploitation. Avoid using the lp=none argument in the kernel command line until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.