CVE-2017-2616 A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root pri...
MediumCVSS 4.7
EPSS 0.28%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/coreutils(Debian:12) | < 8.20-1 | 8.20-1 |
| debian/coreutils(Debian:13) | < 8.20-1 | 8.20-1 |
| debian/coreutils(Debian:14) | < 8.20-1 | 8.20-1 |
| debian/shadow(Debian:12) | < 1:4.4-4 | 1:4.4-4 |
| debian/shadow(Debian:13) | < 1:4.4-4 | 1:4.4-4 |
| debian/shadow(Debian:14) | < 1:4.4-4 | 1:4.4-4 |
| debian/util-linux(Debian:12) | < 2.29.2-1 | 2.29.2-1 |
| debian/util-linux(Debian:13) | < 2.29.2-1 | 2.29.2-1 |
| debian/util-linux(Debian:14) | < 2.29.2-1 | 2.29.2-1 |
| util-linux project util-linux | < 2.32.1 | 2.32.1 |
| debian linux | = 8.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.3 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| alpine/shadow(Alpine:v3.10) | < 4.2.1-r11 | 4.2.1-r11 |
| alpine/shadow(Alpine:v3.11) | < 4.2.1-r11 | 4.2.1-r11 |
| alpine/shadow(Alpine:v3.12) | < 4.2.1-r11 | 4.2.1-r11 |
Show 18 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/shadow(Alpine:v3.13) | < 4.2.1-r11 | 4.2.1-r11 |
| alpine/shadow(Alpine:v3.14) | < 4.2.1-r11 | 4.2.1-r11 |
| alpine/shadow(Alpine:v3.15) | < 4.2.1-r11 | 4.2.1-r11 |
| alpine/shadow(Alpine:v3.16) | < 4.2.1-r11 | 4.2.1-r11 |
| alpine/shadow(Alpine:v3.17) | < 4.2.1-r11 | 4.2.1-r11 |
| alpine/shadow(Alpine:v3.18) | < 4.2.1-r11 | 4.2.1-r11 |
| alpine/shadow(Alpine:v3.19) | < 4.2.1-r11 | 4.2.1-r11 |
| alpine/shadow(Alpine:v3.20) | < 4.2.1-r11 | 4.2.1-r11 |
| alpine/shadow(Alpine:v3.21) | < 4.2.1-r11 | 4.2.1-r11 |
| alpine/shadow(Alpine:v3.22) | < 4.2.1-r11 | 4.2.1-r11 |
| alpine/shadow(Alpine:v3.23) | < 4.2.1-r11 | 4.2.1-r11 |
| alpine/shadow(Alpine:v3.24) | < 4.2.1-r11 | 4.2.1-r11 |
| alpine/shadow(Alpine:v3.5) | < 4.2.1-r7 | 4.2.1-r7 |
| alpine/shadow(Alpine:v3.6) | < 4.2.1-r7 | 4.2.1-r7 |
| alpine/shadow(Alpine:v3.7) | < 4.2.1-r11 | 4.2.1-r11 |
| alpine/shadow(Alpine:v3.8) | < 4.2.1-r11 | 4.2.1-r11 |
| alpine/shadow(Alpine:v3.9) | < 4.2.1-r11 | 4.2.1-r11 |
| linux util-linux | = 2.32.1 | No fix listed |
References
- Debian Security Tracker CVE-2017-2616 vendor-advisory
- RHSA-2017:0654 third-party-advisory vendor-advisory
- 96404 third-party-advisory vdb-entry
- 1038271 third-party-advisory vdb-entry
- RHSA-2017:0907 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- github.com patch third-party-advisory
- GLSA-201706-02 third-party-advisory vendor-advisory
- DSA-3793 third-party-advisory vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking