[arch-security] [ASA-201703-7] linux-grsec: privilege escalation

[Levente Polyak]

Arch Linux Security Advisory ASA-201703-7
=========================================

Severity: Low
Date    : 2017-03-13
CVE-ID  : CVE-2017-2636
Package : linux-grsec
Type    : privilege escalation
Remote  : No
Link    : https://security.archlinux.org/AVG-201

Summary
=======

The package linux-grsec before version 1:4.9.14.r201703121245-1 is
vulnerable to privilege escalation.

Resolution
==========

Upgrade to 1:4.9.14.r201703121245-1.

# pacman -Syu "linux-grsec>=1:4.9.14.r201703121245-1"

The problem has been fixed upstream in version 4.9.14.r201703121245.

Workaround
==========

# echo "install n_hdlc /bin/true" >> /etc/modprobe.d/disable-
n_hdlc.conf

Description
===========

A race condition flaw was found in the N_HLDC Linux kernel driver when
accessing the n_hdlc.tbuf list that can lead to double free. A local,
unprivileged user able to set the HDLC line discipline on the tty
device could use this flaw to crash the system or increase their
privileges on the system.

Impact
======

A local attacker is able to escalate privileges or crash the system if
the n_hdlc kernel module has already been explicitly loaded by an
administrator.

References
==========

https://bugs.archlinux.org/task/53242
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=82f2341c94d270421f383641b7cd670e474db56b
http://seclists.org/oss-sec/2017/q1/569
https://security.archlinux.org/CVE-2017-2636

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20170313/eda9cda4/attachment.asc>