Lucene search

K
archlinuxArchLinuxASA-201701-35
HistoryJan 27, 2017 - 12:00 a.m.

[ASA-201701-35] linux-lts: privilege escalation

2017-01-2700:00:00
security.archlinux.org
22

8.4 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

54.4%

Arch Linux Security Advisory ASA-201701-35

Severity: Medium
Date : 2017-01-27
CVE-ID : CVE-2017-2583
Package : linux-lts
Type : privilege escalation
Remote : No
Link : https://security.archlinux.org/AVG-150

Summary

The package linux-lts before version 4.4.44-1 is vulnerable to
privilege escalation.

Resolution

Upgrade to 4.4.44-1.

pacman -Syu “linux-lts>=4.4.44-1”

The problem has been fixed upstream in version 4.4.44.

Workaround

None.

Description

The Linux kernel > 3.6-rc1, when built with Kernel-based Virtual
Machine (CONFIG_KVM) support, is vulnerable to an incorrect segment
selector (SS) value error. It could occur loading values into SS
register in long mode.
A user/process inside a guest host could use this flaw to crash the
guest, resulting in denial of service, or potentially escalate their
privileges inside the guest system on an AMD processor.

Impact

A local attacker in a guest host is able to crash the system or
escalate privileges inside the guest on an AMD processor.

References

http://seclists.org/oss-sec/2017/q1/137
https://git.kernel.org/linus/33ab91103b3415e12457e3104f0e4517ce12d0f3
https://security.archlinux.org/CVE-2017-2583

OSVersionArchitecturePackageVersionFilename
ArchLinuxanyanylinux-lts< 4.4.44-1UNKNOWN

8.4 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

54.4%

Related for ASA-201701-35