SVG:Advisory-SVG-2017-6074

Main page

Software Security Checklist

Issue Handling

Advisories

Notes On Risk

Advisory Template

More

---

Advisory-SVG-2017-6074

Advisory will be available shortly, probably 28th February.

Title:       [HEADS-UP] Linux kernel root escalation vulnerability [EGI-SVG-2017-6074]  

Date:        2017-02-23

TLP and URL
===========

WHITE information - Unlimited distribution
see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions

URL:   https://wiki.egi.eu/wiki/SVG:Advisory-SVG-2017-6074

Minor updates may be made without re-distribution to the sites

Affected software and risk
==========================

Root escalation vulnerability affecting the Linux kernel

Package : kernel
CVE ID  : CVE-2017-6074

A double-free vulnerability has been found in the linux kernel module 'dccp',
which might allow unprivileged local users to escalate their privileges.
This vulnerability is present in all recent versions of the linux kernel.

The most affected services are those that give shell access to unprivileged users:

- Worker Nodes
- shared User Interface hosts
- ...

Actions required/recommended
============================

The publishing of an exploit is expected to make this a CRITICAL vulnerability.

Sites are therefore advised to deploy the proposed mitigation now and to
plan for a kernel update campaign (including reboot) within the time lines
stated in:

    https://wiki.egi.eu/wiki/SEC03_EGI-CSIRT_Critical_Vulnerability_Handling

Mitigation
==========

This vulnerability can be mitigated by disabling DCCP completely. On standard
distributions, where it's present as a kernel module, this can be achieved by
either:
- Adding a modprobe configuration file to disable dccp by running:
```
echo "install dccp /bin/true" >> /etc/modprobe.d/CVE-2017-6074.conf
```
- Removing all DCCP kernel modules from /lib/modules

If the DCCP kernel module is already loaded (lsmod | grep dccp), a reboot
might be needed to unload the module (rmmod will fail if still in use). Please
note however that most systems don't load this module and a loaded module
should be investigated as it could be from an exploitation attempt.

For other systems, where DCCP is statically compiled in the kernel (use grep
CONFIG_IP_DCCP /boot/config-$(uname -r) or zgrep CONFIG_IP_DCCP
/proc/config.gz. 'm' means module, 'y' means compiled in the kernel directly),
these mitigations cannot be applied and a new kernel has to be built and
deployed.

Credit
======

This vulnerability was reported to EGI SVG by Tobias Dussa.

References
==========

[1] http://seclists.org/oss-sec/2017/q1/471

[2] https://access.redhat.com/security/cve/CVE-2017-6074

[3] https://access.redhat.com/errata/RHSA-2017:0293

[4] https://access.redhat.com/errata/RHSA-2017:0294

[5] https://security-tracker.debian.org/tracker/CVE-2017-6074

[6] https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-6074.html

[7] https://access.redhat.com/security/vulnerabilities/2934281

Timeline  
========

Yyyy-mm-dd  [EGI-SVG-2016-6074] 

2017-02-22 Public disclosure, EGI SVG notified by Tobias Dussa
2017-02-23 Heads-up sent to sites