CVE-2017-2616
published 2018-07-27CVE-2017-2616: A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this…
PriorityP418medium4.7CVSS 3.0
AVLACHPRLUINSUCNINAH
EPSS
0.28%
20.0th percentile
A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.
Affected
33 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | coreutils | < coreutils 8.20-1 (bookworm) | coreutils 8.20-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | shadow | < coreutils 8.20-1 (bookworm) | coreutils 8.20-1 (bookworm) |
| debian | util-linux | < coreutils 8.20-1 (bookworm) | coreutils 8.20-1 (bookworm) |
| gnu | coreutils | >= 0 < 8.20-1 | 8.20-1 |
| gnu | coreutils | >= 0 < 8.20-1 | 8.20-1 |
| gnu | coreutils | >= 0 < 8.20-1 | 8.20-1 |
| gnu | coreutils | >= 0 < 8.20-1 | 8.20-1 |
| kernel | util-linux | >= 0 < 2.29.2-1 | 2.29.2-1 |
| kernel | util-linux | >= 0 < 2.29.2-1 | 2.29.2-1 |
| kernel | util-linux | >= 0 < 2.29.2-1 | 2.29.2-1 |
| kernel | util-linux | >= 0 < 2.29.2-1 | 2.29.2-1 |
| linux | util-linux | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
| shadow_project | shadow | >= 0 < 1:4.4-4 | 1:4.4-4 |
CVSS provenance
nvdv3.04.7MEDIUMCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.7MEDIUMAV:L/AC:M/Au:N/C:N/I:N/A:C
osv7.8HIGH
vendor_redhat9.8CRITICAL
vendor_ubuntu7.8HIGH
vendor_debian5.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qmwq-wgvm-pcqr: A race condition was found in util-linux before 2
ghsa_unreviewed·2022-05-13
CVE-2017-2616 [MEDIUM] CWE-362 GHSA-qmwq-wgvm-pcqr: A race condition was found in util-linux before 2
A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.
GHSA
Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)
ghsa·2018-10-19
CVE-2017-7658 [CRITICAL] CWE-444 Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)
Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)
Eclipse Jetty Server versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), are vulnerable to HTTP Request Smuggling when presented with two content-lengths headers, allowing authorization bypass. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decides on the shorter length, but still passes on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary is imposing authorization, the fake pipelined request bypasses that authorization.
OSV
CVE-2017-2616: A race condition was found in util-linux before 2
osv·2018-07-27·CVSS 4.7
CVE-2017-2616 [MEDIUM] CVE-2017-2616: A race condition was found in util-linux before 2
A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.
OSV
shadow regression
osv·2017-05-17·CVSS 7.8
CVE-2016-6252 [HIGH] shadow regression
shadow regression
USN-3276-1 intended to fix a vulnerability in su. The solution introduced
a regression in su signal handling. This update modifies the security fix.
We apologize for the inconvenience.
Original advisory details:
Sebastian Krahmer discovered integer overflows in shadow utilities.
A local attacker could possibly cause them to crash or potentially
gain privileges via crafted input. (CVE-2016-6252)
Tobias Stöckmann discovered a race condition in su. A local
attacker could cause su to send SIGKILL to other processes with
root privileges. (CVE-2017-2616)
OSV
shadow vulnerabilities
osv·2017-05-05·CVSS 7.8
CVE-2016-6252 [HIGH] shadow vulnerabilities
shadow vulnerabilities
Sebastian Krahmer discovered integer overflows in shadow utilities.
A local attacker could possibly cause them to crash or potentially
gain privileges via crafted input. (CVE-2016-6252)
Tobias Stöckmann discovered a race condition in su. A local
attacker could cause su to send SIGKILL to other processes with
root privileges. (CVE-2017-2616)
Red Hat
jetty: Incorrect header handling
vendor_redhat·2018-06-07·CVSS 9.8
CVE-2017-7658 [CRITICAL] CWE-444 jetty: Incorrect header handling
jetty: Incorrect header handling
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Statement: This issue affects the versions of jetty embedded in the nutch package as shipped with Red Hat Satellite 5. The nutch service is not exposed, as such exploitatio
Ubuntu
shadow vulnerability
vendor_ubuntu·2017-11-14·CVSS 7.8
CVE-2017-2616 [HIGH] shadow vulnerability
Title: shadow vulnerability
Summary: su could be made to crash or stop programs as an administrator.
USN-3276-1 and USN-3276-2 fixed vulnerabilities in shadow. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Sebastian Krahmer discovered integer overflows in shadow utilities.
A local attacker could possibly cause them to crash or potentially
gain privileges via crafted input. (CVE-2016-6252)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
shadow regression
vendor_ubuntu·2017-05-17·CVSS 7.8
CVE-2016-6252 [HIGH] shadow regression
Title: shadow regression
Summary: USN-3276-1 introduced a regression in su.
USN-3276-1 intended to fix a vulnerability in su. The solution introduced
a regression in su signal handling. This update modifies the security fix.
We apologize for the inconvenience.
Original advisory details:
Sebastian Krahmer discovered integer overflows in shadow utilities.
A local attacker could possibly cause them to crash or potentially
gain privileges via crafted input. (CVE-2016-6252)
Tobias Stöckmann discovered a race condition in su. A local
attacker could cause su to send SIGKILL to other processes with
root privileges. (CVE-2017-2616)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
shadow vulnerabilities
vendor_ubuntu·2017-05-05·CVSS 7.8
CVE-2016-6252 [HIGH] shadow vulnerabilities
Title: shadow vulnerabilities
Summary: su could be made to crash or stop programs as an administrator.
Sebastian Krahmer discovered integer overflows in shadow utilities.
A local attacker could possibly cause them to crash or potentially
gain privileges via crafted input. (CVE-2016-6252)
Tobias Stöckmann discovered a race condition in su. A local
attacker could cause su to send SIGKILL to other processes with
root privileges. (CVE-2017-2616)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
util-linux: Sending SIGKILL to other processes with root privileges via su
vendor_redhat·2017-02-22·CVSS 5.5
CVE-2017-2616 [MEDIUM] CWE-267 util-linux: Sending SIGKILL to other processes with root privileges via su
util-linux: Sending SIGKILL to other processes with root privileges via su
A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.
A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.
Package: coreutils (Red Hat Enterprise Linux 5) - Will not fix
Package: shadow-utils (Red Hat Enterprise Linux 5) - Not affected
Package: util-linux (Red Hat Enterprise Linux 5) - Not affected
Package: shadow-utils (Red Hat Enterprise Linux 6) - Not affected
Package: util-lin
Debian
CVE-2017-2616: coreutils - A race condition was found in util-linux before 2.32.1 in the way su handled the...
vendor_debian·2017·CVSS 5.5
CVE-2017-2616 [MEDIUM] CVE-2017-2616: coreutils - A race condition was found in util-linux before 2.32.1 in the way su handled the...
A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.
Scope: local
bookworm: resolved (fixed in 8.20-1)
bullseye: resolved (fixed in 8.20-1)
forky: resolved (fixed in 8.20-1)
sid: resolved (fixed in 8.20-1)
trixie: resolved (fixed in 8.20-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-7658 jetty: Incorrect header handling
bugzilla·2018-06-27·CVSS 9.8
CVE-2017-7658 [CRITICAL] CVE-2017-7658 jetty: Incorrect header handling
CVE-2017-7658 jetty: Incorrect header handling
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Upstream issue:
https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669
Discussion:
Created jetty tracking bugs for this issue:
Affects: fedora-all [bug 1595
Bugzilla
CVE-2017-2616 util-linux: Sending SIGKILL to other processes with root privileges via su [fedora-all]
bugzilla·2017-02-22·CVSS 5.5
CVE-2017-2616 [MEDIUM] CVE-2017-2616 util-linux: Sending SIGKILL to other processes with root privileges via su [fedora-all]
CVE-2017-2616 util-linux: Sending SIGKILL to other processes with root privileges via su [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multipl
Bugzilla
CVE-2017-2616 shadow-utils: util-linux: Sending SIGKILL to other processes with root privileges via su [fedora-all]
bugzilla·2017-02-22·CVSS 5.5
CVE-2017-2616 [MEDIUM] CVE-2017-2616 shadow-utils: util-linux: Sending SIGKILL to other processes with root privileges via su [fedora-all]
CVE-2017-2616 shadow-utils: util-linux: Sending SIGKILL to other processes with root privileges via su [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue a
Bugzilla
CVE-2017-2616 util-linux: Sending SIGKILL to other processes with root privileges via su
bugzilla·2017-02-02·CVSS 5.5
CVE-2017-2616 [MEDIUM] CVE-2017-2616 util-linux: Sending SIGKILL to other processes with root privileges via su
CVE-2017-2616 util-linux: Sending SIGKILL to other processes with root privileges via su
If su is compiled with PAM support, it is possible for any local user to send SIGKILL to other processes with root privileges. To exploit this, the user must be able to perform su with a successful login. This does NOT have to be the root user, even using su with the same id is enough, e.g. "su $(whoami)". SIGKILL can only be sent to processes which were executed after the su process. It is not possible to send SIGKILL to processes which were already running.
Upstream patch in util-linux:
https://github.com/karelzak/util-linux/commit/dffab154d29a288aa171ff50263ecc8f2e14a891
Discussion:
Acknowledgments:
Name: Tobias Stöckmann
---
Created shadow-utils tracking bugs for this issue:
Affects: fedor
http://rhn.redhat.com/errata/RHSA-2017-0654.htmlhttp://www.securityfocus.com/bid/96404http://www.securitytracker.com/id/1038271https://access.redhat.com/errata/RHSA-2017:0907https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2616https://github.com/karelzak/util-linux/commit/dffab154d29a288aa171ff50263ecc8f2e14a891https://security.gentoo.org/glsa/201706-02https://www.debian.org/security/2017/dsa-3793http://rhn.redhat.com/errata/RHSA-2017-0654.htmlhttp://www.securityfocus.com/bid/96404http://www.securitytracker.com/id/1038271https://access.redhat.com/errata/RHSA-2017:0907https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2616https://github.com/karelzak/util-linux/commit/dffab154d29a288aa171ff50263ecc8f2e14a891https://security.gentoo.org/glsa/201706-02https://www.debian.org/security/2017/dsa-3793
2018-07-27
Published