In both current OVAL definition and CVE Tracker, it says for Ubuntu 16.04

While related to the CVE in some way, the 'linux' package in xenial is not affected.

But I have tested many kernel versions in Default 16.04 installation. They are certainly affected by this vulnerability. and after I apply the mitigation, the exploit no longer works.

Is there any reason behind describing them as unaffected?

  • Did you checked it is compiled in (and accessible by user mode?). RHEL did also specify they are not affected: bugzilla.redhat.com/show_bug.cgi?id=1528518 – eckes Mar 20 '18 at 3:14
  • @eckes I tested by exploit.the vulnerability as a normal user with no extra privilege. isn't this enough? – Sajuuk Mar 20 '18 at 3:58
  • It probably is. What kernel are you seeing? 4.4.0-116.140? Strange enough the CVE tracker talks about 4.15 and I have no idea what DNE means :) people.canonical.com/~ubuntu-security/cve/2017/… – eckes Mar 20 '18 at 7:49
  • It is short for "Does Not Exist"., however there is limited information about what does not exist, popular understanding is "Vulnerable Component Does Not Exist", correct me if I'm wrong. – Sajuuk Mar 20 '18 at 9:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.