Race condition in shadow - CVE-2017-2616

Vulnerability identifier: #VU6432

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-2616

CWE-ID: CWE-362

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to race condition within shadow-utils implementation. A local user can kill other processes on the system with root privileges.

shadow
Amazon Linux AMI
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
SUSE Linux
Ubuntu
Fedora
shadow (Alpine package)
util-linux

Install update from GIT repository.

shadow (Alpine package) - update to 4.2.1-r7
util-linux - addressed in versions 2.28.2-2.fc24, 2.28.2-2.fc25

• https://github.com/shadow-maint/shadow/commit/08fd4b69e84364677a10e519ccb25b71710ee686

• Local denial of service in shadow-utils
• Ubuntu update for shadow-utils
• Ubuntu update for shadow
• Amazon Linux AMI update for util-linux
• Ubuntu update for shadow
• SUSE Linux update for util-linux
• SUSE Linux update for util-linux
• OpenSUSE Linux update for util-linux
• OpenSUSE Linux update for util-linux
• SUSE Linux update for coreutils
• Red Hat update for util-linux
• Red Hat update for coreutils
• Race condition in shadow (Alpine package)
• Fedora 24 update for util-linux
• Fedora 25 update for util-linux