Privilege escalation in Linux kernel - CVE-2017-17863

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU9779

Privilege escalation in Linux kernel - CVE-2017-17863

Published: December 26, 2017 / Updated: December 27, 2017


Vulnerability identifier: #VU9779
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-17863
CWE-ID: CWE-190
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to kernel/bpf/verifier.c in the Linux kernel does not check the relationship between pointer values and the BPF stack. A local attacker can run a specially crafted application to trigger integer overflow or invalid memory access and execute arbitrary code with root privileges.

Successful exploitation of the vulnerability may result in system compromise.

Affected software

Linux kernel
Debian Linux
Arch Linux
Ubuntu
Fedora
kernel

How to mitigate CVE-2017-17863

Install update from vendor's website.

kernel - addressed in versions 4.14.11-200.fc26, 4.14.11-300.fc27

External References

Related Security Bulletins