ID CVE-2017-2616
Summary A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.
References
Vulnerable Configurations
  • util-linux Project util-linux 2.24.2-1
    cpe:2.3:a:util-linux_project:util-linux:2.24.2-1
  • util-linux Project util-linux 2.29
    cpe:2.3:a:util-linux_project:util-linux:2.29
  • util-linux Project util-linux 2.29.1
    cpe:2.3:a:util-linux_project:util-linux:2.29.1
  • util-linux Project util-linux 2.29.2
    cpe:2.3:a:util-linux_project:util-linux:2.29.2
  • util-linux Project util-linux 2.30
    cpe:2.3:a:util-linux_project:util-linux:2.30
  • util-linux Project util-linux 2.30.1
    cpe:2.3:a:util-linux_project:util-linux:2.30.1
  • util-linux Project util-linux 2.30.2
    cpe:2.3:a:util-linux_project:util-linux:2.30.2
  • util-linux Project util-linux 2.31
    cpe:2.3:a:util-linux_project:util-linux:2.31
  • Debian Linux 8.0 (Jessie)
    cpe:2.3:o:debian:debian_linux:8.0
  • Red Hat Enterprise Linux Desktop 6.0
    cpe:2.3:o:redhat:enterprise_linux_desktop:6.0
  • RedHat Enterprise Linux Desktop 7.0
    cpe:2.3:o:redhat:enterprise_linux_desktop:7.0
  • Red Hat Enterprise Linux Server 6.0
    cpe:2.3:o:redhat:enterprise_linux_server:6.0
  • RedHat Enterprise Linux Server 7.0
    cpe:2.3:o:redhat:enterprise_linux_server:7.0
  • Red Hat Enterprise Linux Advanced mission critical Update Support (AUS) 7.3
    cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3
  • Red Hat Enterprise Linux Server Advanced mission critical Update Support (AUS) 7.4
    cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4
  • Red Hat Enterprise Linux Server Extended Update Support (EUS) 7.3
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3
  • Red Hat Enterprise Linux Server Extended Update Support (EUS) 7.4
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4
  • Red Hat Enterprise Linux Server Extended Update Support (EUS) 7.5
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5
  • Red Hat Enterprise Linux Workstation 6.0
    cpe:2.3:o:redhat:enterprise_linux_workstation:6.0
  • RedHat Enterprise Linux Workstation 7.0
    cpe:2.3:o:redhat:enterprise_linux_workstation:7.0
CVSS
Base: 4.7
Impact:
Exploitability:
CWE CWE-362
CAPEC
  • Leveraging Race Conditions
    This attack targets a race condition occurring when multiple processes access and manipulate the same resource concurrently and the outcome of the execution depends on the particular order in which the access takes place. The attacker can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance a race condition can occur while accessing a file, the attacker can trick the system by replacing the original file with his version and cause the system to read the malicious file.
  • Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
    This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. The typical example is the file access. The attacker can leverage a file access race condition by "running the race", meaning that he would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the attacker could do something such as replace the file and cause an escalation of privilege.
nessus via4
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201706-02.NASL
    description The remote host is affected by the vulnerability described in GLSA-201706-02 (Shadow: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Shadow. Please review the CVE identifiers referenced below for details. Impact : A local attacker could possibly cause a Denial of Service condition, gain privileges via crafted input, or SIGKILL arbitrary processes. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-09-24
    plugin id 100629
    published 2017-06-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=100629
    title GLSA-201706-02 : Shadow: Multiple vulnerabilities
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3793.NASL
    description Several vulnerabilities were discovered in the shadow suite. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2016-6252 An integer overflow vulnerability was discovered, potentially allowing a local user to escalate privileges via crafted input to the newuidmap utility. - CVE-2017-2616 Tobias Stoeckmann discovered that su does not properly handle clearing a child PID. A local attacker can take advantage of this flaw to send SIGKILL to other processes with root privileges, resulting in denial of service.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 97397
    published 2017-02-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97397
    title Debian DSA-3793-1 : shadow - security update
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-0553-1.NASL
    description This update for util-linux fixes a number of bugs and two security issues. The following security bugs were fixed : - CVE-2016-5011: Infinite loop DoS in libblkid while parsing DOS partition (bsc#988361) - CVE-2017-2616: In su with PAM support it was possible for local users to send SIGKILL to selected other processes with root privileges (bsc#1023041). The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-30
    plugin id 97380
    published 2017-02-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97380
    title SUSE SLES12 Security Update : util-linux (SUSE-SU-2017:0553-1)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2017-1083.NASL
    description According to the version of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. (CVE-2017-2616) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-14
    plugin id 99949
    published 2017-05-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99949
    title EulerOS 2.0 SP1 : util-linux (EulerOS-SA-2017-1083)
  • NASL family Virtuozzo Local Security Checks
    NASL id VIRTUOZZO_VZLSA-2017-0907.NASL
    description An update for util-linux is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program. Security Fix(es) : * A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. (CVE-2017-2616) Red Hat would like to thank Tobias StAPckmann for reporting this issue. Bug Fix(es) : * The 'findmnt --target ' command prints all file systems where the mount point directory is . Previously, when used in the chroot environment, 'findmnt --target ' incorrectly displayed all mount points. The command has been fixed so that it now checks the mount point path and returns information only for the relevant mount point. (BZ#1414481) Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-20
    plugin id 101446
    published 2017-07-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101446
    title Virtuozzo 7 : libblkid / libblkid-devel / libmount / etc (VZLSA-2017-0907)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2017-0654.NASL
    description An update for coreutils is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages. Security Fix(es) : * A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. (CVE-2017-2616) Red Hat would like to thank Tobias Stockmann for reporting this issue. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 97956
    published 2017-03-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97956
    title CentOS 6 : coreutils (CESA-2017:0654)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20170321_COREUTILS_ON_SL6_X.NASL
    description Security Fix(es) : - A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. (CVE-2017-2616)
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 99215
    published 2017-04-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99215
    title Scientific Linux Security Update : coreutils on SL6.x i386/x86_64
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-838.NASL
    description Tobias Stoeckmann discovered that su does not properly handle clearing a child PID. A local attacker can take advantage of this flaw to send SIGKILL to other processes with root privileges, resulting in denial of service. For Debian 7 'Wheezy', these problems have been fixed in version 4.1.5.1-1+deb7u1. We recommend that you upgrade your shadow packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-09-24
    plugin id 97396
    published 2017-02-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97396
    title Debian DLA-838-1 : shadow security update
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-3276-1.NASL
    description Sebastian Krahmer discovered integer overflows in shadow utilities. A local attacker could possibly cause them to crash or potentially gain privileges via crafted input. (CVE-2016-6252) Tobias Stockmann discovered a race condition in su. A local attacker could cause su to send SIGKILL to other processes with root privileges. (CVE-2017-2616). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 99993
    published 2017-05-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99993
    title Ubuntu 14.04 LTS / 16.04 LTS / 16.10 / 17.04 : shadow vulnerabilities (USN-3276-1)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2017-0907.NASL
    description From Red Hat Security Advisory 2017:0907 : An update for util-linux is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program. Security Fix(es) : * A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. (CVE-2017-2616) Red Hat would like to thank Tobias Stockmann for reporting this issue. Bug Fix(es) : * The 'findmnt --target ' command prints all file systems where the mount point directory is . Previously, when used in the chroot environment, 'findmnt --target ' incorrectly displayed all mount points. The command has been fixed so that it now checks the mount point path and returns information only for the relevant mount point. (BZ#1414481)
    last seen 2019-02-21
    modified 2018-09-24
    plugin id 99330
    published 2017-04-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99330
    title Oracle Linux 7 : util-linux (ELSA-2017-0907)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-0866-1.NASL
    description This update for coreutils fixes one issue. This security issue was fixed : - CVE-2017-2616: In su with PAM support it was possible for local users to send SIGKILL to selected other processes with root privileges (bsc#1023041) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 108830
    published 2018-04-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=108830
    title SUSE SLES11 Security Update : coreutils (SUSE-SU-2018:0866-1)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-3276-2.NASL
    description USN-3276-1 intended to fix a vulnerability in su. The solution introduced a regression in su signal handling. This update modifies the security fix. We apologize for the inconvenience. Sebastian Krahmer discovered integer overflows in shadow utilities. A local attacker could possibly cause them to crash or potentially gain privileges via crafted input. (CVE-2016-6252) Tobias Stockmann discovered a race condition in su. A local attacker could cause su to send SIGKILL to other processes with root privileges. (CVE-2017-2616). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 100248
    published 2017-05-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=100248
    title Ubuntu 14.04 LTS / 16.04 LTS / 16.10 / 17.04 : shadow regression (USN-3276-2)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2017-B11B460865.NASL
    description Security fix for CVE-2017-2616 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-09-24
    plugin id 97483
    published 2017-03-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97483
    title Fedora 24 : util-linux (2017-b11b460865)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20170412_UTIL_LINUX_ON_SL7_X.NASL
    description Security Fix(es) : - A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. (CVE-2017-2616) Bug Fix(es) : - The 'findmnt --target ' command prints all file systems where the mount point directory is . Previously, when used in the chroot environment, 'findmnt --target ' incorrectly displayed all mount points. The command has been fixed so that it now checks the mount point path and returns information only for the relevant mount point.
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 99354
    published 2017-04-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99354
    title Scientific Linux Security Update : util-linux on SL7.x x86_64
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2017-0907.NASL
    description An update for util-linux is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program. Security Fix(es) : * A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. (CVE-2017-2616) Red Hat would like to thank Tobias Stockmann for reporting this issue. Bug Fix(es) : * The 'findmnt --target ' command prints all file systems where the mount point directory is . Previously, when used in the chroot environment, 'findmnt --target ' incorrectly displayed all mount points. The command has been fixed so that it now checks the mount point path and returns information only for the relevant mount point. (BZ#1414481)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 99341
    published 2017-04-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99341
    title RHEL 7 : util-linux (RHSA-2017:0907)
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2017-0052.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : - clean up empty file if cp is failed [Orabug 15973168] - pure rebuild to bring back support for acl_extended_file_nofollow on x86_64 - su: deny killing other processes with root privileges (CVE-2017-2616) - fix the functionality of 'sort -h -k ...' in multi-byte locales (#1357979) - use correct path to grep(1) in colorls.sh (#1376892) - make colorls.sh compatible with ksh (#1321643) - sed should actually be /bin/sed (related #1222140) - colorls.sh,colorls.csh - call utilities with complete path (#1222140) - mkdir, mkfifo, mknod - respect default umask/acls when COREUTILS_CHILD_DEFAULT_ACLS envvar is set (to match rhel 7 behaviour, - ls: improve efficiency on filesystems without support for ACLs, xattrs or SELinux (#1248141) - su: suppress PAM info messages for -c or non-login sessions (#1267588) - tail, stat: recognize several new filesystems - up2date by Jan 1st 2016 (#1280333) - du: improve du error message of coreutils commands in a chrooted environment (patch by Boris Ranto) (#1086916) - su: fix incorrect message printing when su is killed (#1147532)
    last seen 2019-02-21
    modified 2018-09-24
    plugin id 99079
    published 2017-03-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99079
    title OracleVM 3.3 / 3.4 : coreutils (OVMSA-2017-0052)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2017-0654.NASL
    description From Red Hat Security Advisory 2017:0654 : An update for coreutils is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages. Security Fix(es) : * A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. (CVE-2017-2616) Red Hat would like to thank Tobias Stockmann for reporting this issue. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.
    last seen 2019-02-21
    modified 2018-09-24
    plugin id 99068
    published 2017-03-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99068
    title Oracle Linux 6 : coreutils (ELSA-2017-0654)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2017-0654.NASL
    description An update for coreutils is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages. Security Fix(es) : * A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. (CVE-2017-2616) Red Hat would like to thank Tobias Stockmann for reporting this issue. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.
    last seen 2019-02-21
    modified 2018-11-26
    plugin id 97879
    published 2017-03-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97879
    title RHEL 6 : coreutils (RHSA-2017:0654)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-0554-1.NASL
    description This update for util-linux fixes the following issues: This security issue was fixed : - CVE-2017-2616: In su with PAM support it was possible for local users to send SIGKILL to selected other processes with root privileges (bsc#1023041). The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-30
    plugin id 97381
    published 2017-02-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97381
    title SUSE SLED12 / SLES12 Security Update : util-linux (SUSE-SU-2017:0554-1)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-305.NASL
    description This update for util-linux fixes the following issues : This security issue was fixed : - CVE-2017-2616: In su with PAM support it was possible for local users to send SIGKILL to selected other processes with root privileges (bsc#1023041). This non-security issues were fixed : - lscpu: Implement WSL detection and work around crash (bsc#1019332) - fstrim: De-duplicate btrfs sub-volumes for 'fstrim -a' and bind mounts (bsc#1020077) - Fix regressions in safe loop re-use patch set for libmount (bsc#1012504) - Disable ro checks for mtab (bsc#1012632) - Ensure that the option 'users,exec,dev,suid' work as expected on NFS mounts (bsc#1008965) This update was imported from the SUSE:SLE-12-SP1:Update update project.
    last seen 2019-02-21
    modified 2018-09-24
    plugin id 97564
    published 2017-03-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97564
    title openSUSE Security Update : util-linux (openSUSE-2017-305)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2017-1084.NASL
    description According to the version of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. (CVE-2017-2616) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-14
    plugin id 99950
    published 2017-05-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99950
    title EulerOS 2.0 SP2 : util-linux (EulerOS-SA-2017-1084)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-306.NASL
    description This update for util-linux fixes the following issues : This security issue was fixed : - CVE-2017-2616: In su with PAM support it was possible for local users to send SIGKILL to selected other processes with root privileges (bsc#1023041). This non-security issues were fixed : - lscpu: Implement WSL detection and work around crash (bsc#1019332) - fstrim: De-duplicate btrfs sub-volumes for 'fstrim -a' and bind mounts (bsc#1020077) - Fix regressions in safe loop re-use patch set for libmount (bsc#1012504) - Disable ro checks for mtab (bsc#1012632) - Ensure that the option 'users,exec,dev,suid' work as expected on NFS mounts (bsc#1008965) - Fix empty slave detection to prevent 100% CPU load in some cases (bsc#1020985) This update was imported from the SUSE:SLE-12-SP2:Update update project.
    last seen 2019-02-21
    modified 2018-09-24
    plugin id 97565
    published 2017-03-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97565
    title openSUSE Security Update : util-linux (openSUSE-2017-306)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2017-20710607F5.NASL
    description Security fix for CVE-2017-2616 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-09-24
    plugin id 97450
    published 2017-03-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97450
    title Fedora 25 : util-linux (2017-20710607f5)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2017-823.NASL
    description Sending SIGKILL to other processes with root privileges via su : A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.(CVE-2017-2616)
    last seen 2019-02-21
    modified 2018-09-24
    plugin id 99711
    published 2017-04-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99711
    title Amazon Linux AMI : util-linux (ALAS-2017-823)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-0555-1.NASL
    description This update for util-linux fixes the following issues: This security issue was fixed : - CVE-2017-2616: In su with PAM support it was possible for local users to send SIGKILL to selected other processes with root privileges (bsc#1023041). The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-30
    plugin id 97382
    published 2017-02-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97382
    title SUSE SLED12 / SLES12 Security Update : util-linux (SUSE-SU-2017:0555-1)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2017-0907.NASL
    description An update for util-linux is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program. Security Fix(es) : * A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. (CVE-2017-2616) Red Hat would like to thank Tobias Stockmann for reporting this issue. Bug Fix(es) : * The 'findmnt --target ' command prints all file systems where the mount point directory is . Previously, when used in the chroot environment, 'findmnt --target ' incorrectly displayed all mount points. The command has been fixed so that it now checks the mount point path and returns information only for the relevant mount point. (BZ#1414481)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 99380
    published 2017-04-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99380
    title CentOS 7 : util-linux (CESA-2017:0907)
redhat via4
advisories
  • bugzilla
    id 1418710
    title CVE-2017-2616 util-linux: Sending SIGKILL to other processes with root privileges via su
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 6 Client is installed
        oval oval:com.redhat.rhsa:tst:20100842001
      • comment Red Hat Enterprise Linux 6 Server is installed
        oval oval:com.redhat.rhsa:tst:20100842002
      • comment Red Hat Enterprise Linux 6 Workstation is installed
        oval oval:com.redhat.rhsa:tst:20100842003
      • comment Red Hat Enterprise Linux 6 ComputeNode is installed
        oval oval:com.redhat.rhsa:tst:20100842004
    • OR
      • AND
        • comment coreutils is earlier than 0:8.4-46.el6
          oval oval:com.redhat.rhsa:tst:20170654005
        • comment coreutils is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20131652006
      • AND
        • comment coreutils-libs is earlier than 0:8.4-46.el6
          oval oval:com.redhat.rhsa:tst:20170654007
        • comment coreutils-libs is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20131652008
    rhsa
    id RHSA-2017:0654
    released 2017-03-21
    severity Moderate
    title RHSA-2017:0654: coreutils security and bug fix update (Moderate)
  • bugzilla
    id 1418710
    title CVE-2017-2616 util-linux: Sending SIGKILL to other processes with root privileges via su
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 7 Client is installed
        oval oval:com.redhat.rhsa:tst:20140675001
      • comment Red Hat Enterprise Linux 7 Server is installed
        oval oval:com.redhat.rhsa:tst:20140675002
      • comment Red Hat Enterprise Linux 7 Workstation is installed
        oval oval:com.redhat.rhsa:tst:20140675003
      • comment Red Hat Enterprise Linux 7 ComputeNode is installed
        oval oval:com.redhat.rhsa:tst:20140675004
    • OR
      • AND
        • comment libblkid is earlier than 0:2.23.2-33.el7_3.2
          oval oval:com.redhat.rhsa:tst:20170907007
        • comment libblkid is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20111691008
      • AND
        • comment libblkid-devel is earlier than 0:2.23.2-33.el7_3.2
          oval oval:com.redhat.rhsa:tst:20170907011
        • comment libblkid-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20111691010
      • AND
        • comment libmount is earlier than 0:2.23.2-33.el7_3.2
          oval oval:com.redhat.rhsa:tst:20170907009
        • comment libmount is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20162605014
      • AND
        • comment libmount-devel is earlier than 0:2.23.2-33.el7_3.2
          oval oval:com.redhat.rhsa:tst:20170907013
        • comment libmount-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20162605020
      • AND
        • comment libuuid is earlier than 0:2.23.2-33.el7_3.2
          oval oval:com.redhat.rhsa:tst:20170907005
        • comment libuuid is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20111691014
      • AND
        • comment libuuid-devel is earlier than 0:2.23.2-33.el7_3.2
          oval oval:com.redhat.rhsa:tst:20170907015
        • comment libuuid-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20111691012
      • AND
        • comment util-linux is earlier than 0:2.23.2-33.el7_3.2
          oval oval:com.redhat.rhsa:tst:20170907019
        • comment util-linux is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20162605008
      • AND
        • comment uuidd is earlier than 0:2.23.2-33.el7_3.2
          oval oval:com.redhat.rhsa:tst:20170907017
        • comment uuidd is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20111691016
    rhsa
    id RHSA-2017:0907
    released 2017-04-12
    severity Moderate
    title RHSA-2017:0907: util-linux security and bug fix update (Moderate)
rpms
  • coreutils-0:8.4-46.el6
  • coreutils-libs-0:8.4-46.el6
  • libblkid-0:2.23.2-33.el7_3.2
  • libblkid-devel-0:2.23.2-33.el7_3.2
  • libmount-0:2.23.2-33.el7_3.2
  • libmount-devel-0:2.23.2-33.el7_3.2
  • libuuid-0:2.23.2-33.el7_3.2
  • libuuid-devel-0:2.23.2-33.el7_3.2
  • util-linux-0:2.23.2-33.el7_3.2
refmap via4
bid 96404
confirm
debian DSA-3793
gentoo GLSA-201706-02
sectrack 1038271
Last major update 27-07-2018 - 15:29
Published 27-07-2018 - 15:29
Last modified 21-09-2018 - 09:49
Back to Top