ArchLinux: 201601-26: linux-lts: privilege escalation
Summary
It was reported that possible use-after-free vulnerability in keyring facility, possibly leading to local privilege escalation, was found. Function join_session_keyring in security/keys/process_keys.c holds a reference to the requested keyring, but if that keyring is the same as the one being currently used by the process, the kernel wouldn't decrease keyring->usage before returning to userspace. The usage field can be possibly overflowed causing use-after-free on the keyring object.
Resolution
Upgrade to 4.1.16-1.
# pacman -Syu "linux-lts>=4.1.16-1"
The problem has been fixed upstream in version 4.1.16.
References
https://access.redhat.com/security/cve/CVE-2016-0728 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/ https://bugs.archlinux.org/task/47820
Workaround
None.