Privilege escalation in Linux kernel - CVE-2017-0605

Vulnerability identifier: #VU7252

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-0605

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to gain elevated privileges.

The weakness exists due to a flaw in the kernel trace subsystem. A local attacker can run a specially crafted application and execute arbitrary code with root privileges.

Successful exploitation of the vulnerability may result in system compromise.

Linux kernel
Ubuntu
Slackware Linux
linux-4.4.276/kernel-generic
linux-4.4.276/kernel-huge
linux-4.4.276/kernel-modules
linux-4.4.276/kernel-headers

Install update from vendor's website.

linux-4.4.276/kernel-generic - update to 4.4.276
linux-4.4.276/kernel-huge - update to 4.4.276
linux-4.4.276/kernel-modules - update to 4.4.276
linux-4.4.276/kernel-headers - update to 4.4.276_smp

• https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=2161ae9a70b12cf18ac8e5952a20161ffb...
• https://source.android.com/security/bulletin/2017-05-01

• Ubuntu update for Linux kernel (Trusty HWE)
• Ubuntu update for Linux kernel
• Ubuntu update for Linux kernel (HWE)
• Ubuntu update for Linux kernel
• Ubuntu update for Linux kernel
• Slackware Linux update for kernel