Discovered past times Venustech ADLab (Active-Defense Lab) researchers, the Linux nub vulnerability (CVE-2017-15265) is due to a use-after-free retentivity mistake inward the Advanced Linux Sound Architecture (ALSA) sequencer interface of the affected application.
The Advanced Linux Sound Architecture (ALSA) provides well in addition to MIDI functionality to the Linux operating system, in addition to also bundles a userspace driven library for application developers, enabling straight (kernel) interaction alongside well devices through ALSA libraries.
Successful exploitation of this vulnerability requires an attacker—with local access on the targeted system—to execute a maliciously crafted application on a targeted system, which allows the assailant to bring upwards his privilege to root on the targeted system, a Cisco advisory warned.
The vulnerability affects major distributions of the Linux operating organisation including RedHat, Debian, Ubuntu, in addition to Suse, in addition to is triggered past times a skid inward snd_seq_create_port().
This "snd_seq_create_port() creates a port object in addition to returns its pointer, but it doesn't accept the refcount, thence it tin flame endure deleted right away past times around other thread," the researchers wrote inward an advisory published Wednesday.
"Meanwhile, snd_seq_ioctl_create_port() however calls the component snd_seq_system_client_ev_port_start() alongside the created port object that is existence deleted, in addition to this triggers use-after-free."The vulnerability has been patched inward Linux nub version 4.13.4-2, which was fixed only past times taking the refcount properly at "snd_seq_create_port()" in addition to letting the caller unref the object later use.
Administrators are advised to apply the appropriate updates on their Linux distributions every bit shortly every bit they have them from their respective distro. They're also recommended to allow alone trusted users to access local systems in addition to ever monitor affected systems.
This flaw is yet around other privilege escalation vulnerability late uncovered inward the Linux kernel.
Last month, a high-risk 2-year-old potential local privilege escalation flaw was patched inward the Linux nub that affected all major Linux distributions, including Red Hat, Debian, in addition to CentOS.
In February, around other privilege-escalation vulnerability that dates dorsum to 2011 disclosed in addition to patched inward the Linux nub which also affected major Linux distro, including Redhat, Debian, OpenSUSE, in addition to Ubuntu.
