Arch Linux: ASA-201706-35 Medium: libnl Elevation of Privileges

Arch Linux Security Advisory ASA-201706-35
=========================================
Severity: Medium
Date    : 2017-06-28
CVE-ID  : CVE-2017-0553
Package : libnl
Type    : privilege escalation
Remote  : No
Link    : https://security.archlinux.org/AVG-292

Summary
======
The package libnl before version 3.3.0-1 is vulnerable to privilege
escalation.

Resolution
=========
Upgrade to 3.3.0-1.

# pacman -Syu "libnl>=3.3.0-1"

The problem has been fixed upstream in version 3.3.0.

Workaround
=========
None.

Description
==========
An integer overflow vulnerability has been found in the nlmsg_reserve()
function of libnl < 3.3.0, allowing local privilege escalation.

Impact
=====
A local attacker is able to escalate privileges.

References
=========
http://git.infradead.org/users/tgr/libnl.git/commitdiff/3e18948f17148e6a3c4255bdeaaf01ef6081ceeb?hp=3dd2a0f26fa59896b4b4a262cf309a4be4aa70d3
https://security.archlinux.org/CVE-2017-0553