CVE-2017-2636: Race Condition
A race condition flaw was found in the NHLDC Linux kernel driver when accessing nhdlc.tbuf that can lead to double free.
A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to increase their privileges on the system.
Other sources
Race condition in drivers/tty/nhdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2636?
CVE-2017-2636 is classified as a high severity vulnerability due to its potential to allow privilege escalation.
Who is affected by CVE-2017-2636?
Local, unprivileged users on affected versions of the Linux kernel can exploit CVE-2017-2636.
How does CVE-2017-2636 exploit a vulnerability?
CVE-2017-2636 exploits a race condition in the N_HLDC Linux kernel driver leading to a double free condition.
How do I fix CVE-2017-2636?
To fix CVE-2017-2636, it is recommended to update to a patched version of the Linux kernel that resolves this issue.
What versions of the Linux kernel are affected by CVE-2017-2636?
CVE-2017-2636 affects various versions of the Linux kernel, specifically those between 2.6.31 and 4.10.3.