Arch Linux Security Advisory ASA-201703-7 ========================================= Severity: Low Date : 2017-03-13 CVE-ID : CVE-2017-2636 Package : linux-grsec Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-201 Summary ======= The package linux-grsec before version 1:4.9.14.r201703121245-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1:4.9.14.r201703121245-1. # pacman -Syu "linux-grsec>=1:4.9.14.r201703121245-1" The problem has been fixed upstream in version 4.9.14.r201703121245. Workaround ========== # echo "install n_hdlc /bin/true" >> /etc/modprobe.d/disable- n_hdlc.conf Description =========== A race condition flaw was found in the N_HLDC Linux kernel driver when accessing the n_hdlc.tbuf list that can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to crash the system or increase their privileges on the system. Impact ====== A local attacker is able to escalate privileges or crash the system if the n_hdlc kernel module has already been explicitly loaded by an administrator. References ========== https://bugs.archlinux.org/task/53242 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... http://seclists.org/oss-sec/2017/q1/569 https://security.archlinux.org/CVE-2017-2636