Bug 1061284 (CVE-2017-14954)

Summary: VUL-0: CVE-2017-14954: kernel-source: KASLR kernel/exit.c privilege escalation
Product: [Novell Products] SUSE Security Incidents Reporter: Alexander Bergmann <abergmann>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED UPSTREAM QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: bpetkov, meissner, smash_bz, tiwai
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/192708/
Whiteboard: CVSSv3:RedHat:CVE-2017-14954:3.3:(AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) CVSSv2:SUSE:CVE-2017-14954:4.1:(AV:L/AC:M/Au:S/C:P/I:P/A:P) CVSSv3:SUSE:CVE-2017-14954:5.3:(AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) CVSSv2:NVD:CVE-2017-14954:2.1:(AV:L/AC:L/Au:N/C:P/I:N/A:N)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Alexander Bergmann 2017-10-02 14:13:31 UTC

The waitid implementation in kernel/exit.c in the Linux kernel through 4.13.4
accesses rusage data structures in unintended cases, which allows local users to
obtain sensitive information, and bypass the KASLR protection mechanism, via a
crafted system call.

Comment 1 Takashi Iwai 2017-10-11 13:52:35 UTC
The commit ce72a16fa705f960ca2352e95a7c5f4801475e75 is only found in 4.13, not backported to stable / older kernels, so this is only for TW.

Should be fixed through stable updates soon later, I suppose.
Comment 2 Borislav Petkov 2017-10-20 08:02:21 UTC
And it is. Bouncing back...
Comment 3 Marcus Meissner 2018-02-09 06:56:48 UTC
fixed upstream in newer kernels