CVE-2017-2616: Race Condition
A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.
Other sources
If su is compiled with PAM support, it is possible for any local user to send SIGKILL to other processes with root privileges. To exploit this, the user must be able to perform su with a successful login. This does NOT have to be the root user, even using su with the same id is enough, e.g. "su $(whoami)". SIGKILL can only be sent to processes which were executed after the su process. It is not possible to send SIGKILL to processes which were already running.
Upstream patch in util-linux:
https://github.com/karelzak/util-linux/commit/dffab154d29a288aa171ff50263ecc8f2e14a891
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2616?
CVE-2017-2616 is considered a medium severity vulnerability that allows local authenticated attackers to potentially kill processes with root privileges.
How do I fix CVE-2017-2616?
To fix CVE-2017-2616, you should upgrade to util-linux version 2.32.1 or newer, as well as ensure your coreutils and shadow packages are updated to their respective fixed versions.
Which systems are affected by CVE-2017-2616?
CVE-2017-2616 affects systems using util-linux before version 2.32.1, which includes certain versions in Debian and Red Hat distributions.
Can CVE-2017-2616 be exploited remotely?
No, CVE-2017-2616 can only be exploited locally by authenticated users with access to the system.
Is CVE-2017-2616 related to PAM support in su?
Yes, CVE-2017-2616 is particularly concerning if su is compiled with PAM support, as it allows for greater potential to exploit the vulnerability.