Bug 1061284 – VUL-0: CVE-2017-14954: kernel-source: KASLR kernel/exit.c privilege escalation

Bug 1061284 - (CVE-2017-14954) VUL-0: CVE-2017-14954: kernel-source: KASLR kernel/exit.c privilege escalation

(CVE-2017-14954)
Summary:	VUL-0: CVE-2017-14954: kernel-source: KASLR kernel/exit.c privilege escalation

Status:	RESOLVED UPSTREAM

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/192708/
Whiteboard:	CVSSv3:RedHat:CVE-2017-14954:3.3:(AV:...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2017-10-02 14:13 UTC by Alexander Bergmann
Modified:	2018-02-09 07:36 UTC (History)
CC List:	4 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Alexander Bergmann 2017-10-02 14:13:31 UTC

CVE-2017-14954

The waitid implementation in kernel/exit.c in the Linux kernel through 4.13.4
accesses rusage data structures in unintended cases, which allows local users to
obtain sensitive information, and bypass the KASLR protection mechanism, via a
crafted system call.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-14954
https://twitter.com/grsecurity/status/914079864478666753
https://twitter.com/_argp/status/914021130712870912
https://grsecurity.net/~spender/exploits/wait_for_kaslr_to_be_effective.c
https://github.com/torvalds/linux/commit/6c85501f2fabcfc4fc6ed976543d252c4eaf4be9
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6c85501f2fabcfc4fc6ed976543d252c4eaf4be9

Comment 1 Takashi Iwai 2017-10-11 13:52:35 UTC

The commit ce72a16fa705f960ca2352e95a7c5f4801475e75 is only found in 4.13, not backported to stable / older kernels, so this is only for TW.

Should be fixed through stable updates soon later, I suppose.

Comment 2 Borislav Petkov 2017-10-20 08:02:21 UTC

And it is. Bouncing back...

Comment 3 Marcus Meissner 2018-02-09 06:56:48 UTC

fixed upstream in newer kernels