Security readout for executives and security teams
Plain-English summary
CVE-2017-11472 is a Linux kernel information leak in ACPI shutdown handling. A local user could trigger a kernel stack dump through a crafted ACPI table, exposing kernel memory and weakening KASLR protections on some kernels. This is not shown as remotely exploitable in the provided sources.
Executive priority
Handle through normal kernel patch management, with higher priority for shared Linux systems and environments with untrusted local users. The business risk is kernel memory disclosure and weakening of exploit mitigations, but the provided sources do not show remote exploitation or active exploitation.
Technical view
The flaw is in acpi_ns_terminate() in drivers/acpi/acpica/nsutils.c before Linux 4.12. The function failed to flush the operand cache, causing a kernel stack dump. The CVE states this allowed local users to obtain sensitive kernel memory and bypass KASLR in kernels through 4.9.
Likely exposure
Exposure is most likely on Linux systems running kernels before 4.12, especially kernels through 4.9 where the CVE notes KASLR bypass. Systems without local untrusted users are lower risk. The bundle does not identify affected distro package versions beyond Ubuntu advisories.
Exploitation context
The source bundle describes local-user exploitation through a crafted ACPI table. It does not cite CISA KEV listing, public active exploitation, remote attack paths, or weaponized exploitation details. Treat this as a local privilege-adjacent information disclosure risk, not confirmed active exploitation.
Researcher notes
Key evidence is the CVE description and upstream Linux and ACPICA commits. The affected product metadata in the bundle is sparse, so distribution-specific exposure must be validated against vendor advisories. Avoid assuming every Linux before 4.12 is exploitable in the same deployment conditions.
Mitigation direction
- Apply vendor kernel updates that include the Linux or ACPICA fix.
- For Ubuntu systems, review USN-3619-1, USN-3619-2, and USN-3754-1.
- Check whether running kernels include upstream commit 3b2d69114fefa474fca542e51119036dceb4aa6f.
- Restrict local shell access on systems that cannot be updated promptly.
- Follow your Linux vendor guidance for supported backported fixes.
Validation and detection
- Inventory Linux kernel versions and identify hosts running kernels before 4.12.
- Confirm distro kernel packages map to the referenced vendor advisories or upstream fix.
- Prioritize multi-user servers, shared workstations, and hosts with untrusted local users.
- Verify reboot completion after kernel updates so patched kernels are active.
- Record unsupported kernels as exceptions requiring upgrade or compensating access controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-11472 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- USN-3619-2CVE reference · vendor-advisory, x_refsource_UBUNTU
- USN-3754-1CVE reference · vendor-advisory, x_refsource_UBUNTU
- https://github.com/torvalds/linux/commit/3b2d69114fefa474fca542e51119036dceb4aa6fCVE reference · x_refsource_CONFIRM
- https://github.com/acpica/acpica/commit/a23325b2e583556eae88ed3f764e457786bf4df6CVE reference · x_refsource_CONFIRM
- USN-3619-1CVE reference · vendor-advisory, x_refsource_UBUNTU
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.