Privilege escalation in Red Hat Enterprise Linux for x86_64 - CVE-2017-15097

Vulnerability identifier: #VU9616

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-15097

CWE-ID: CWE-362

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to a race condition in several of the initialization and setup scripts. A local attacker with 'postgres' user privileges can obtain root privileges.

Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
rh-postgresql94-postgresql (Red Hat package)
rh-postgresql95-postgresql (Red Hat package)
rh-postgresql96-postgresql (Red Hat package)

Install update from vendor's website.

rh-postgresql94-postgresql (Red Hat package) - addressed in versions 9.4.14-2.el6, 9.4.14-2.el7
rh-postgresql95-postgresql (Red Hat package) - addressed in versions 9.5.9-4.el6, 9.5.9-4.el7
rh-postgresql96-postgresql (Red Hat package) - addressed in versions 9.6.5-2.el6, 9.6.5-2.el7

• https://access.redhat.com/security/cve/CVE-2017-15097

• Privilege escalation in Red Hat Enterprise Linux
• Red Hat update for postgresql
• Red Hat Software Collections update for rh-postgresql94-postgresql
• Red Hat Software Collections update for rh-postgresql96-postgresql
• Red Hat Software Collections update for rh-postgresql95-postgresql