Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

Arch Linux 201703-8 High Severity: Privilege Escalation Risk

Calendar Mar 14, 2017 • User Avatar LinuxSecurity Advisories
1 - 2 min read
Archlinux Large Esm H446
Topics%20covered

Topics Covered

security advisory high severity privilege escalation linux kernel arch linux
The package linux before version 4.10.2-1 is vulnerable to privilege escalation. 
Arch Linux Security Advisory ASA-201703-8
========================================
Severity: High
Date    : 2017-03-14
CVE-ID  : CVE-2017-2636
Package : linux
Type    : privilege escalation
Remote  : No
Link    : https://security.archlinux.org/AVG-192

Summary
======
The package linux before version 4.10.2-1 is vulnerable to privilege
escalation.

Resolution
=========
Upgrade to 4.10.2-1.

# pacman -Syu "linux>=4.10.2-1"

The problem has been fixed upstream in version 4.10.2.

Workaround
=========
# echo "install n_hdlc /bin/true" >> /etc/modprobe.d/disable-
n_hdlc.conf

Description
==========
A race condition flaw was found in the N_HLDC Linux kernel driver when
accessing the n_hdlc.tbuf list that can lead to double free. A local,
unprivileged user able to set the HDLC line discipline on the tty
device could use this flaw to crash the system or increase their
privileges on the system.

Impact
=====
A local attacker is able to escalate privileges or crash the system.

References
=========
https://bugs.archlinux.org/task/53242
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=82f2341c94d270421f383641b7cd670e474db56b
https://seclists.org/oss-sec/2017/q1/569
https://security.archlinux.org/CVE-2017-2636