Privilege escalation in kdelibs and kauth - CVE-2017-8422

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU6597

Privilege escalation in kdelibs and kauth - CVE-2017-8422

Published: May 17, 2017 / Updated: September 14, 2018


Vulnerability identifier: #VU6597
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-8422
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to a logic flaw in the affected software. A local attacker could make a specially crafted call, spoof the caller identity and gain root privileges.

Successful exploitation of the vulnerability may result in full access to the system.

Affected software

kdelibs
kauth
Gentoo Linux
Arch Linux
Red Hat Enterprise Linux for x86_64
CentOS
Fedora
SUSE Linux
Ubuntu
kdelibs
kf5-kauth

How to mitigate CVE-2017-8422

Update KDE kauth to version 5.34.
Update KDE kdelibs to version 4.14.32

kdelibs - addressed in versions 4.14.30-2.fc24, 4.14.30-2.fc25, 4.14.30-2.fc26
kf5-kauth - addressed in versions 5.33.0-2.el7, 5.33.0-2.fc24, 5.33.0-2.fc25, 5.33.0-2.fc26

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins