CVE-2017-7874: Linux Kernel 4.8.0 UDEV < 232 Local Privilege Escalation Vulnerability
by CIRT Team
Description: udevd in udev 232, when the Linux kernel 4.8.0 is used, does not properly verify the source of a Netlink message, which allows local users to execute arbitrary commands by leveraging access to the NETLINK_KOBJECT_UEVENT family, and the presence of the /lib/udev/rules.d/50-udev-default.rules file, to provide a crafted REMOVE_CMD value.
Impact: Local attackers may exploit this issue to execute arbitrary commands with elevated privileges.
Mitigation: Updates are available. Please check specific vendor advisory for more information.
Reference URL’s:
- http://www.securityfocus.com/bid/97679
- http://www.cvedetails.com/cve/CVE-2017-7874/
- https://access.redhat.com/security/cve/cve-2016-7874
- https://security-tracker.debian.org/tracker/CVE-2017-7874
Recommended Posts
Cyber Threat Alert: Surge in Attacks via Compromised Third-Party Service Providers
08 Feb 2024 - Articles, English articles, Security Advisories & Alerts
Subscribe here
MEMBER OF:
