CVE-2017-1000363

What it actually does

Out-of-bounds write in the static parport_nr array in drivers/char/lp.c caused by missing bounds checking when many 'lp=none' arguments are supplied on the kernel command line.

Why it matters to the business

Attackers who can influence the bootloader or kernel command line may achieve local kernel memory corruption, potentially leading to privilege escalation and full system compromise on affected Linux deployments.

How an attack unfolds

An adversary first gains the ability to append kernel command-line parameters (for example via a bootloader vulnerability), then supplies a large number of 'lp=none' arguments exceeding LP_NO to trigger the static array overflow and corrupt adjacent kernel memory.

How to fix it

Upgrade affected packages to the listed fixed versions: wordpress/wordpress to commit 14150f546a4e4006cb92e1688d70c6d9e08513cc; consul-1.16 and related images to version 0 where applicable. Rebuild and redeploy kernels or containers with patched lp.c code; restrict bootloader access and validate command-line integrity at boot.

How to confirm the fix worked

Confirm package versions match the fixed releases, test boot with repeated 'lp=none' arguments to verify the bounds check prevents overflow, and review kernel source or binary for the corrected parport_ptr handling.

Typical attack path

1. Obtain limited control over the kernel command line via bootloader or early-boot flaw
2. Append more than LP_NO instances of the 'lp=none' argument
3. Trigger array overflow during early kernel initialization
4. Corrupt adjacent kernel structures to escalate privileges or execute arbitrary code

How to detect it

Inspect kernel boot logs and bootloader configuration files for unusually long sequences of 'lp=none' arguments; correlate with any unexplained kernel oops or memory corruption events around the lp driver initialization.

• lp=none lp=none lp=none
• parport_nr array overflow
• drivers/char/lp.c

What your security team should do

• Apply the exact fixed package versions immediately on all affected systems
• Harden bootloader configurations to prevent unauthorized command-line modification
• Monitor EPSS and exploit maturity indicators for any future increase in risk
• Audit downstream dependents for indirect exposure through container base images