Security Alert (A17-09-09): Vulnerability in Linux Kernel

Description:

A vulnerability was found in the memory management of the affected operating systems.  This vulnerability can lead to privilege escalation on these systems by corrupting memory and executing arbitrary code.  A local attacker may leverage this vulnerability in the affected systems to gain root privileges.

Affected Systems:

The following is only a sample list of Linux systems that are affected. The list is not exhaustive and it is strongly recommended to consult the product vendors if the used Linux systems are affected.

• All versions of CentOS 6
• CentOS 7 versions prior to 1708
• All versions of Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7 prior to 7.4
• Linux operating systems (on 32-bit and 64-bit) based on kernel version prior to 3.10.77

Impact:

Successful exploitation could lead to elevation of privilege of a vulnerable system.

Recommendation:

The vulnerability is fixed in some of the Linux distributions, such as CentOS, Debian, Oracle Linux, RedHat, SUSE and Ubuntu. System administrators should check with their product vendors to confirm if their Linux systems are affected and the availability of patches, and if so, apply the patches or follow the recommendations provided by the product vendors to mitigate the risk.

• CentOS 6
  https://lists.centos.org/pipermail/centos-announce/2017-September/022548.html
  
  
• CentOS 7
  https://lists.centos.org/pipermail/centos-announce/2017-September/022532.html
  
  
• Debian
  https://security-tracker.debian.org/tracker/CVE-2017-1000253
  
  
• Oracle Linux
  https://linux.oracle.com/errata/ELSA-2017-2795.html
  
  
• RedHat
  https://access.redhat.com/security/cve/CVE-2017-1000253
  
  
• SUSE
  https://www.suse.com/security/cve/CVE-2017-1000253/
  
  
• Ubuntu
  https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-1000253.html
  
  

More Information:

https://www.qualys.com/2017/09/26/cve-2017-1000253/cve-2017-1000253.txt
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a87938b2e246b81b4fb713edb371a9fa3c5c3c86
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000253