Bug 1061284 (CVE-2017-14954)

Summary: VUL-0: CVE-2017-14954: kernel-source: KASLR kernel/exit.c privilege escalation
Product: [Novell Products] SUSE Security Incidents Reporter: Alexander Bergmann <abergmann>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED UPSTREAM QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: bpetkov, meissner, smash_bz, tiwai
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/192708/
Whiteboard: CVSSv3:RedHat:CVE-2017-14954:3.3:(AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) CVSSv2:SUSE:CVE-2017-14954:4.1:(AV:L/AC:M/Au:S/C:P/I:P/A:P) CVSSv3:SUSE:CVE-2017-14954:5.3:(AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) CVSSv2:NVD:CVE-2017-14954:2.1:(AV:L/AC:L/Au:N/C:P/I:N/A:N)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Alexander Bergmann 2017-10-02 14:13:31 UTC
CVE-2017-14954

The waitid implementation in kernel/exit.c in the Linux kernel through 4.13.4
accesses rusage data structures in unintended cases, which allows local users to
obtain sensitive information, and bypass the KASLR protection mechanism, via a
crafted system call.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-14954
https://twitter.com/grsecurity/status/914079864478666753
https://twitter.com/_argp/status/914021130712870912
https://grsecurity.net/~spender/exploits/wait_for_kaslr_to_be_effective.c
https://github.com/torvalds/linux/commit/6c85501f2fabcfc4fc6ed976543d252c4eaf4be9
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6c85501f2fabcfc4fc6ed976543d252c4eaf4be9
Comment 1 Takashi Iwai 2017-10-11 13:52:35 UTC
The commit ce72a16fa705f960ca2352e95a7c5f4801475e75 is only found in 4.13, not backported to stable / older kernels, so this is only for TW.

Should be fixed through stable updates soon later, I suppose.
Comment 2 Borislav Petkov 2017-10-20 08:02:21 UTC
And it is. Bouncing back...
Comment 3 Marcus Meissner 2018-02-09 06:56:48 UTC
fixed upstream in newer kernels