PT-2017-15451 · Util Linux+5 · Util-Linux+5

Tobias Stoeckmann · Published 2017-02-22 · Updated 2024-06-15 · CVE-2017-2616

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions util-linux versions prior to 2.32.1

Description A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.

Recommendations For versions prior to 2.32.1, update to version 2.32.1 or later to resolve the issue.

Fix

Race Condition

Weakness Enumeration

CWE-362

CWE-267

Related Identifiers

ALT-PU-2019-1609

CESA-2017_0654

CESA-2017_0907

CVE-2017-2616

DLA-838-1

DSA-3793-1

DSA-3793-2

MGASA-2017-0072

OPENSUSE-SU-2017_0589-1

OPENSUSE-SU-2017_0590-1

OPENSUSE-SU-2024:11282-1

RHSA-2017:0654

RHSA-2017:0907

RHSA-2017_0654

RHSA-2017_0907

SUSE-SU-2017:0553-1

SUSE-SU-2017:0554-1

SUSE-SU-2017:0555-1

SUSE-SU-2017:2699-1

SUSE-SU-2017:2700-1

SUSE-SU-2017_0554-1

SUSE-SU-2017_0555-1

SUSE-SU-2018:0866-1

SUSE-SU-2018_0866-1

USN-3276-1

USN-3276-2

USN-3276-3

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Util-Linux

References · 55

• https://github.com/karelzak/util-linux/commit/dffab154d29a288aa171ff50263ecc8f2e14a891 · Patch
• https://ubuntu.com/security/CVE-2016-6252 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:0553-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0866-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0072 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-2616 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-2616 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-2616 · Security Note
• https://linux.oracle.com/errata/ELSA-2017-0654.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:0907 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3276-2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2616 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3793-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0072.html · Security Note
• https://ubuntu.com/security/notices/USN-3276-3 · Vendor Advisory