CVE-2017-6516: Input Validation
A Local Privilege Escalation Vulnerability in MagniComp's Sysinfo before 10-H64 for Linux and UNIX platforms could allow a local attacker to gain elevated privileges. Parts of SysInfo require setuid-to-root access in order to access restricted system files and make restricted kernel calls. This access could be exploited by a local attacker to gain a root shell prompt using the right combination of environment variables and command line arguments.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A local attacker who can execute Sysinfo on an affected Linux or UNIX system can exploit it. The CVSS vector indicates that high privileges are required before exploitation.
What does successful exploitation allow?
Successful exploitation can provide a root shell, resulting in complete compromise of confidentiality, integrity, and availability on the affected host.
Which installations are affected?
Sysinfo versions before 10-H64 for Linux and UNIX platforms are affected. The issue concerns Sysinfo components that use setuid-to-root access to read restricted files or make restricted kernel calls.
What conditions are needed for exploitation?
The attacker needs to supply the appropriate combination of environment variables and command-line arguments to the setuid-root Sysinfo functionality. No user interaction is required.