Remote No

Type Privilege escalation

Description

It was discovered that when the waitid() syscall in Linux kernel v4.13 was refactored, it accidentally stopped checking that the incoming argument was pointing to userspace. This allowed local attackers to write directly to kernel memory, which could lead to privilege escalation.

AVG-455 linux-lts 4.9.55-1 4.9.56-1 High Not affected

AVG-446 linux-hardened 4.13.6.a-1 4.13.7.a-1 High Fixed

AVG-445 linux-zen 4.13.6-1 4.13.7-1 High Fixed

AVG-444 linux 4.13.6-1 4.13.7-1 High Fixed

17 Oct 2017 ASA-201710-26 AVG-444 linux High privilege escalation

16 Oct 2017 ASA-201710-25 AVG-446 linux-hardened High privilege escalation

16 Oct 2017 ASA-201710-24 AVG-445 linux-zen High privilege escalation

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=96ca579a1ecc943b75beba58bebb0356f6cc4b51

Introduced by: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4c48abe91be03d191d0c20cc755877da2cb35622