CVE-2017-2616
Summary
| CVE | CVE-2017-2616 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2018-07-27 19:29:00 UTC |
|---|
| Updated | 2019-10-09 23:26:00 UTC |
|---|
| Description | A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| su: properly clear child PID · karelzak/util-linux@dffab15 · GitHub |
CONFIRM |
github.com |
Patch, Third Party Advisory |
| Red Hat Customer Portal |
REDHAT |
access.redhat.com |
Third Party Advisory |
| util-linux CVE-2017-2616 Local Denial of Service Vulnerability |
BID |
www.securityfocus.com |
Third Party Advisory, VDB Entry |
| Red Hat Customer Portal |
REDHAT |
rhn.redhat.com |
Third Party Advisory |
| Shadow: Multiple vulnerabilities (GLSA 201706-02) — Gentoo Security |
GENTOO |
security.gentoo.org |
Third Party Advisory |
| Util-linux Child Process Race Condition Lets Local Users Kill Root-Owned Processes in Certain Cases - SecurityTracker |
SECTRACK |
www.securitytracker.com |
Third Party Advisory, VDB Entry |
| Debian -- Security Information -- DSA-3793-1 shadow |
DEBIAN |
www.debian.org |
Third Party Advisory |
| 1418710 – (CVE-2017-2616) CVE-2017-2616 util-linux: Sending SIGKILL to other processes with root privileges via su |
CONFIRM |
bugzilla.redhat.com |
Issue Tracking, Patch, Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 378252 Virtuozzo Linux Security Update for libuuid-devel (VZLSA-2017:0907)
- 501249 Alpine Linux Security Update for shadow
- 710457 Gentoo Linux Shadow Multiple Vulnerabilities (GLSA 201706-02)
