Bug 1418710 – CVE-2017-2616 util-linux: Sending SIGKILL to other processes with root privileges via su

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1418710 - (CVE-2017-2616) CVE-2017-2616 util-linux: Sending SIGKILL to other processes with root privileges via su

Summary:	CVE-2017-2616 util-linux: Sending SIGKILL to other processes with root privil...

Status:	CLOSED ERRATA

Aliases:	CVE-2017-2616

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20170222,repor...
Keywords:	Security

Depends On:	1419474 1419475 1420262 1425713 1425714
Blocks:	1386080 1418721
	Show dependency tree / graph

Reported:	2017-02-02 09:53 EST by Adam Mariš
Modified:	2018-07-27 06:15 EDT (History)
CC List:	7 users (show)

See Also:
Fixed In Version:	util-linux 2.32.1
Doc Type:	If docs needed, set a value
Doc Text:	A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-04-12 16:12:26 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2017:0654	normal	SHIPPED_LIVE	Moderate: coreutils security and bug fix update	2017-03-21 08:33:06 EDT
Red Hat Product Errata	RHSA-2017:0907	normal	SHIPPED_LIVE	Moderate: util-linux security and bug fix update	2017-04-12 12:25:06 EDT

Groups: None (edit)

Description Adam Mariš 2017-02-02 09:53:58 EST

If su is compiled with PAM support, it is possible for any local user to send SIGKILL to other processes with root privileges. To exploit this, the user must be able to perform su with a successful login. This does NOT have to be the root user, even using su with the same id is enough, e.g. "su $(whoami)". SIGKILL can only be sent to processes which were executed after the su process. It is not possible to send SIGKILL to processes which were already running.

Upstream patch in util-linux:

https://github.com/karelzak/util-linux/commit/dffab154d29a288aa171ff50263ecc8f2e14a891

Comment 14 Dhiru Kholia 2017-02-09 02:52:21 EST

Acknowledgments:

Name: Tobias Stöckmann

Comment 15 Dhiru Kholia 2017-02-22 03:22:34 EST

Created shadow-utils tracking bugs for this issue:

Affects: fedora-all [bug 1425714]

Comment 16 Dhiru Kholia 2017-02-22 03:22:42 EST

Created util-linux tracking bugs for this issue:

Affects: fedora-all [bug 1425713]

Comment 17 errata-xmlrpc 2017-03-21 06:08:47 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:0654 https://rhn.redhat.com/errata/RHSA-2017-0654.html

Comment 18 errata-xmlrpc 2017-04-12 08:33:38 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:0907 https://access.redhat.com/errata/RHSA-2017:0907

Note You need to log in before you can comment on or make changes to this bug.