CVE-2017-15274

security/keys/keyctl.c in the Linux kernel before 4.11.5 does not consider the case of a NULL payload in conjunction with a nonzero length value, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted add_key or keyctl system call, a different vulnerability than CVE-2017-12192.

• CWE-476

• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5649645d725c73df4302428ee4e02c869248b4c5Issue Tracking, Patch, Third Party Advisory
• http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.5Release Notes, Vendor Advisory
• http://www.securityfocus.com/bid/101292Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:1946
• https://bugzilla.suse.com/show_bug.cgi?id=1045327Issue Tracking, Third Party Advisory
• https://github.com/torvalds/linux/commit/5649645d725c73df4302428ee4e02c869248b4c5Issue Tracking, Patch, Third Party Advisory
• https://patchwork.kernel.org/patch/9781573/Issue Tracking, Patch, Vendor Advisory
• https://usn.ubuntu.com/3583-1/
• https://usn.ubuntu.com/3583-2/
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5649645d725c73df4302428ee4e02c869248b4c5Issue Tracking, Patch, Third Party Advisory
• http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.5Release Notes, Vendor Advisory
• http://www.securityfocus.com/bid/101292Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:1946
• https://bugzilla.suse.com/show_bug.cgi?id=1045327Issue Tracking, Third Party Advisory
• https://github.com/torvalds/linux/commit/5649645d725c73df4302428ee4e02c869248b4c5Issue Tracking, Patch, Third Party Advisory
• https://patchwork.kernel.org/patch/9781573/Issue Tracking, Patch, Vendor Advisory
• https://usn.ubuntu.com/3583-1/
• https://usn.ubuntu.com/3583-2/

Published

Oct 12, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15269The PSFTPd 10.0.4 Build 729 server does not prevent FTP boun…
• CVE-2017-1527IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable…
• CVE-2017-15270The PSFTPd 10.0.4 Build 729 server does not properly escape …
• CVE-2017-15271A use-after-free issue could be triggered remotely in the SF…
• CVE-2017-15272The PSFTPd 10.0.4 Build 729 server stores its configuration …
• CVE-2017-15273Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 be…
• CVE-2017-15275Samba before 4.7.3 might allow remote attackers to obtain se…7.5
• CVE-2017-15276OpenText Documentum Content Server (formerly EMC Documentum …
• CVE-2017-15277ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and Grap…
• CVE-2017-15278Cross-Site Scripting (XSS) was discovered in TeamPass before…
• CVE-2017-15279Cross-site scripting (XSS) vulnerability in Umbraco CMS befo…
• CVE-2017-15280XML external entity (XXE) vulnerability in Umbraco CMS befor…