CVE-2017-2647

What it actually does

Local NULL pointer dereference in the KEYS subsystem's keyring_search_iterator function allows unprivileged users to trigger a kernel crash or escalate privileges.

Why it matters to the business

Systems running unpatched kernels before version 3.18 face risk of denial of service or full local compromise, potentially enabling attackers to access sensitive data or persist on servers and endpoints.

How an attack unfolds

An attacker with local shell access invokes keyring operations that supply a NULL match field, causing the kernel to dereference a null pointer during search iteration and either crash the system or corrupt kernel state to gain elevated privileges.

How to fix it

Upgrade the Linux kernel to a version containing commit c06cfb08b88dfbe13be44a69ae2fdc3a7c902d81 or later; rebuild and reboot all affected systems with the patched kernel.

How to confirm the fix worked

Verify the running kernel version is 3.18 or newer and confirm the presence of commit c06cfb08b88dfbe13be44a69ae2fdc3a7c902d81 in the source tree; test keyring operations under local accounts to ensure no crash occurs.

Typical attack path

1. Obtain local unprivileged access to a vulnerable Linux system
2. Craft and execute keyctl or related syscall sequences that pass a NULL match value into the keyring search path
3. Trigger the NULL dereference in keyring_search_iterator to achieve denial of service or privilege escalation

How to detect it

Review kernel logs for NULL pointer dereference panics mentioning keyring.c or keyring_search_iterator; audit local processes making unusual keyctl syscalls; check for post-exploit artifacts such as unexpected root processes or modified keyrings.

What your security team should do

• Immediately identify all systems running kernels older than 3.18 and schedule emergency patching
• Restrict local user access and keyring capabilities via SELinux or AppArmor until patches are applied
• Monitor for kernel oops or panic logs referencing keyring_search_iterator