PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5669 Canonical CVE debrief

CVE-2017-5669 is a local Linux kernel vulnerability in the shared-memory attach path. The flaw can let an attacker map page zero, which weakens a protection intended to stop NULL-page mappings via mmap. NVD rates the issue High severity, and the supplied record ties it to affected Linux kernel builds and downstream distro packages.

Vendor
Canonical
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-24
Original CVE updated
2026-05-13
Advisory published
2017-02-24
Advisory updated
2026-05-13

Who should care

Linux kernel administrators, distro security teams, and organizations running affected Debian or Ubuntu systems should care most. Any environment that allows untrusted local users on vulnerable kernels deserves review, especially where kernel packages may lag behind upstream fixes.

Technical summary

The NVD description says do_shmat in ipc/shm.c fails to restrict an address produced by a rounding operation. That can allow an unintended mapping at page zero and bypass the protection that mmap normally enforces against NULL-page mappings. The supplied NVD record classifies the issue as local, low-complexity, no-user-interaction, and high impact for confidentiality, integrity, and availability.

Defensive priority

High

Recommended defensive actions

  • Upgrade to a kernel build or vendor package that includes the upstream fix references associated with this CVE.
  • Check fleet exposure against the NVD scope for Linux kernels before 4.11, and review affected downstream packages called out for Debian 8.0 and Ubuntu 12.04/14.04 ESM in the supplied CPE data.
  • Prioritize systems that allow untrusted local accounts, containers, or shared login access, since the issue requires local attack conditions.
  • Use vendor advisories and the linked kernel bug/patched commits to confirm the exact fixed package version for each distribution.
  • Reassess any security assumptions that depend on blocking NULL-page mappings through mmap alone.

Evidence notes

This debrief is based only on the supplied NVD/CVE corpus and the official links listed there. The CVE was published on 2017-02-24 and the supplied NVD record was modified on 2026-05-13. The description states the bug affects Linux kernel through 4.9.12, while the NVD CPE criteria mark Linux kernel versions before 4.11 as vulnerable. Related official references in the corpus include the NVD record, the CVE record, a kernel Bugzilla entry, upstream Linux commits, and Debian/Ubuntu advisories.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5669 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5669

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5669 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5669

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.