CVE-2017-6001

Published: 18 February 2017

Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain privileges via a crafted application that makes concurrent perf_event_open system calls for moving a software group into a hardware context. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-6786.

From the Ubuntu Security Team

Di Shen discovered that a race condition existed in the perf subsystem of the Linux kernel. A local attacker could use this to cause a denial of service or possibly gain administrative privileges.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6001
• https://ubuntu.com/security/notices/USN-3312-1
• https://ubuntu.com/security/notices/USN-3312-2
• https://ubuntu.com/security/notices/USN-3361-1
• https://source.android.com/security/bulletin/pixel/2017-11-01
• NVD
• Launchpad
• Debian