Security Alert (A17-09-09): Vulnerability in Linux Kernel


 

Published on: 28 September 2017

Description:

A vulnerability was found in the memory management of the affected operating systems.  This vulnerability can lead to privilege escalation on these systems by corrupting memory and executing arbitrary code.  A local attacker may leverage this vulnerability in the affected systems to gain root privileges.

 

Affected Systems:

The following is only a sample list of Linux systems that are affected. The list is not exhaustive and it is strongly recommended to consult the product vendors if the used Linux systems are affected.

  • All versions of CentOS 6
  • CentOS 7 versions prior to 1708
  • All versions of Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7 prior to 7.4
  • Linux operating systems (on 32-bit and 64-bit) based on kernel version prior to 3.10.77

 

Impact:

Successful exploitation could lead to elevation of privilege of a vulnerable system.

 

Recommendation:

The vulnerability is fixed in some of the Linux distributions, such as CentOS, Debian, Oracle Linux, RedHat, SUSE and Ubuntu. System administrators should check with their product vendors to confirm if their Linux systems are affected and the availability of patches, and if so, apply the patches or follow the recommendations provided by the product vendors to mitigate the risk.

  • CentOS 6
    https://lists.centos.org/pipermail/centos-announce/2017-September/022548.html

  • CentOS 7
    https://lists.centos.org/pipermail/centos-announce/2017-September/022532.html

  • Debian
    https://security-tracker.debian.org/tracker/CVE-2017-1000253

  • Oracle Linux
    https://linux.oracle.com/errata/ELSA-2017-2795.html

  • RedHat
    https://access.redhat.com/security/cve/CVE-2017-1000253

  • SUSE
    https://www.suse.com/security/cve/CVE-2017-1000253/

  • Ubuntu
    https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-1000253.html

 

More Information:

https://www.qualys.com/2017/09/26/cve-2017-1000253/cve-2017-1000253.txt
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a87938b2e246b81b4fb713edb371a9fa3c5c3c86
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000253

 



Tag: Linux , Kernel , CentOS , Red Hat
Tags