CVE-2017-7495

fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs-flushing-before-commit list, which allows local users to obtain sensitive information from other users' files in opportunistic circumstances by waiting for a hardware reset, creating a new file, making write system calls, and reading this file.

• CWE-200

• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=06bd3c36a733ac27962fea7d6f47168841376824Issue Tracking, Patch, Third Party Advisory
• http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.2Release Notes, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2017/05/15/2Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/98491
• https://bugzilla.redhat.com/show_bug.cgi?id=1450261Issue Tracking, Patch, Third Party Advisory
• https://github.com/torvalds/linux/commit/06bd3c36a733ac27962fea7d6f47168841376824Issue Tracking, Patch, Third Party Advisory
• https://source.android.com/security/bulletin/2017-09-01
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=06bd3c36a733ac27962fea7d6f47168841376824Issue Tracking, Patch, Third Party Advisory
• http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.2Release Notes, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2017/05/15/2Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/98491
• https://bugzilla.redhat.com/show_bug.cgi?id=1450261Issue Tracking, Patch, Third Party Advisory
• https://github.com/torvalds/linux/commit/06bd3c36a733ac27962fea7d6f47168841376824Issue Tracking, Patch, Third Party Advisory
• https://source.android.com/security/bulletin/2017-09-01

Published

May 15, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-7489In Moodle 2.x and 3.x, remote authenticated users can take o…
• CVE-2017-7490In Moodle 2.x and 3.x, searching of arbitrary blogs is possi…
• CVE-2017-7491In Moodle 2.x and 3.x, a CSRF attack is possible that allows…
• CVE-2017-7492Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-7493Quick Emulator (Qemu) built with the VirtFS, host directory …7.8
• CVE-2017-7494Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.1…9.8
• CVE-2017-7496fedora-arm-installer up to and including 1.99.16 is vulnerab…
• CVE-2017-7497The dialog for creating cloud volumes (cinder provider) in C…4.1
• CVE-2017-7498Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-7499Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-7500It was found that rpm did not properly handle RPM installati…7.3
• CVE-2017-7501It was found that versions of rpm before 4.13.0.2 use tempor…