[arch-security] [ASA-201701-35] linux-lts: privilege escalation

[Christian Rebischke]

Arch Linux Security Advisory ASA-201701-35
==========================================

Severity: Medium
Date    : 2017-01-27
CVE-ID  : CVE-2017-2583
Package : linux-lts
Type    : privilege escalation
Remote  : No
Link    : https://security.archlinux.org/AVG-150

Summary
=======

The package linux-lts before version 4.4.44-1 is vulnerable to
privilege escalation.

Resolution
==========

Upgrade to 4.4.44-1.

# pacman -Syu "linux-lts>=4.4.44-1"

The problem has been fixed upstream in version 4.4.44.

Workaround
==========

None.

Description
===========

The Linux kernel > 3.6-rc1, when built with Kernel-based Virtual
Machine (CONFIG_KVM) support, is vulnerable to an incorrect segment
selector (SS) value error. It could occur loading values into SS
register in long mode.
A user/process inside a guest host could use this flaw to crash the
guest, resulting in denial of service, or potentially escalate their
privileges inside the guest system on an AMD processor.

Impact
======

A local attacker in a guest host is able to crash the system or
escalate privileges inside the guest on an AMD processor.

References
==========

http://seclists.org/oss-sec/2017/q1/137
https://git.kernel.org/linus/33ab91103b3415e12457e3104f0e4517ce12d0f3
https://security.archlinux.org/CVE-2017-2583
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20170127/5fa67fd9/attachment.asc>