Bug 1061284 - (CVE-2017-14954) VUL-0: CVE-2017-14954: kernel-source: KASLR kernel/exit.c privilege escalation
(CVE-2017-14954)
VUL-0: CVE-2017-14954: kernel-source: KASLR kernel/exit.c privilege escalation
Status: RESOLVED UPSTREAM
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/192708/
CVSSv3:RedHat:CVE-2017-14954:3.3:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-10-02 14:13 UTC by Alexander Bergmann
Modified: 2018-02-09 07:36 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2017-10-02 14:13:31 UTC
CVE-2017-14954

The waitid implementation in kernel/exit.c in the Linux kernel through 4.13.4
accesses rusage data structures in unintended cases, which allows local users to
obtain sensitive information, and bypass the KASLR protection mechanism, via a
crafted system call.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-14954
https://twitter.com/grsecurity/status/914079864478666753
https://twitter.com/_argp/status/914021130712870912
https://grsecurity.net/~spender/exploits/wait_for_kaslr_to_be_effective.c
https://github.com/torvalds/linux/commit/6c85501f2fabcfc4fc6ed976543d252c4eaf4be9
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6c85501f2fabcfc4fc6ed976543d252c4eaf4be9
Comment 1 Takashi Iwai 2017-10-11 13:52:35 UTC
The commit ce72a16fa705f960ca2352e95a7c5f4801475e75 is only found in 4.13, not backported to stable / older kernels, so this is only for TW.

Should be fixed through stable updates soon later, I suppose.
Comment 2 Borislav Petkov 2017-10-20 08:02:21 UTC
And it is. Bouncing back...
Comment 3 Marcus Meissner 2018-02-09 06:56:48 UTC
fixed upstream in newer kernels