CVE-2017-7184

Source
Severity Medium
Remote No
Type Privilege escalation
Description
A local privilege escalation vulnerability has been found in the Linux kernel.
Chaitin Security Research Lab discovered that xfrm_replay_verify_len(), as called by xfrm_new_ae(), did not verify that the user-specified replay_window was within the replay state buffer. This allowed for out-of-bounds reads and writes of kernel memory. Chaitin Security showed that this can lead to local privilege escalation by using user namespaces in order to configure XFRM. 
XFRM configuration requires CAP_NET_ADMIN so this issue is mitigated in kernels which do not enable user namespaces by default.
Group Package Affected Fixed Severity Status Ticket
AVG-230 linux-lts 4.9.18-1 4.9.20-1 Medium Not affected
AVG-229 linux-zen 4.10.6-1 Medium Not affected
AVG-228 linux 4.10.6-1 Medium Not affected
References
http://www.openwall.com/lists/oss-security/2017/03/29/2
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=677e806da4d916052585301785d847c3b3e6186a
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f843ee6dd019bcece3e74e76ad9df0155655d0df
Notes
This is the local privilege escalation used against Ubuntu during the 2017 pwn2own contest.