Linux Kernel inotify_handle_event() and vfs_rename() Privilege Escalation Vulnerability [CVE-2017-7533]

CVE Number – CVE-2017-7533

A vulnerability in Linux Kernel could allow a local attacker to gain elevated privileges on a targeted system.

The vulnerability is due to a race condition in the affected system. An attacker could exploit this vulnerability by renaming a targeted file to overwrite data or pointers. A successful exploit could allow the attacker to gain elevated privileges, and execute arbitrary code with those privileges, on the targeted system.

Functional code that demonstrates an exploit of this vulnerability is publicly available.

The vendor has confirmed the vulnerability, and software patches are available.

Technical Information

• The vulnerability exists in the inotify_handle_event() and vfs_rename() functions, and is due to a race condition in the affected system.
  
  A local attacker could exploit this vulnerability by renaming a targeted file to overwrite data or pointers. A successful exploit could allow the attacker to gain elevated privileges, and execute arbitrary code with those privileges, on the targeted system.

Analysis

• To exploit this vulnerability, the attacker must have local access to the targeted system. This access requirement may reduce the likelihood of a successful exploit.
  
  A working exploit is publicly available for 32-bit kernels. 64-bit kernels are also affected by this vulnerability; however, a working exploit has not been identified.

Safeguards

• Administrators are advised to apply the appropriate updates.
  
  Administrators are advised to allow only trusted users to access local systems.
  
  Administrators are advised to allow only privileged users to access administration or management systems.
  
  Administrators are advised to monitor affected systems.

Vendor Announcements

• Kernel.org has released a git commit at the following link: CVE-2017-7533
  
  Red Hat has released an official CVE statement and security advisories for bug 1468283 at the following links: CVE-2017-7533, RHSA-2017:2473, RHSA-2017-2585, RHSA-2017-2669, RHSA-2017:2770, and RHSA-2017:2869

Fixed Software

• Kernel.org has released a patch at the following link: dentry name snapshots
  
  Red Hat has released updated software for registered subscribers at the following link: Red Hat Network. Red Hat packages can be updated on Red Hat Enterprise Linux versions 5 and later by using the yum tool.