CVE-2017-6964 - CVE House
Back to Database
Status published High CVE-2017-6964

dmcrypt-get-device, as shipped in the eject package of Debian and...

Vulnerability Description

dmcrypt-get-device, as shipped in the eject package of Debian and Ubuntu, does not check the return value of the (1) setuid or (2) setgid function, which might cause dmcrypt-get-device to execute code, which was intended to run as an unprivileged user, as root. This affects eject through 2.1.5+deb1+cvs20081104-13.1 on Debian, eject before 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.10.1 on Ubuntu 16.10, eject before 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.04.1 on Ubuntu 16.04 LTS, eject before 2.1.5+deb1+cvs20081104-13.1ubuntu0.14.04.1 on Ubuntu 14.04 LTS, and eject before 2.1.5+deb1+cvs20081104-9ubuntu0.1 on Ubuntu 12.04 LTS.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-6964

Credits & Attribution

No credits recorded in the NVD database.

References

More from canonical

View All →
CVE-2025-31479
canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output
High 8.2
CVE-2025-24375
MySQL K8s charm could leak credentials for root-level user `serverconfig`
Medium 5
CVE-2024-41129
The ops library leaks secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
Medium 4.4
CVE-2020-8632
In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small...
Medium 5.5
CVE-2020-8631
cloud-init through 19.4 relies on Mersenne Twister for a random...
Medium 5.5

Affected Vendor

Affected Software

ubuntu linux, debian linux
Vulnerable Versions:
12.04, 14.04, 16.04, 16.10, 8.0

Timeline

Official Publish: March 28th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.