fix use-after-free in sys_ioprio_get() in kernel critical CVE-2016-7911 [released]

Tracked by Jolla (In release)

asked 2017-04-26 12:00:28 +0200

this post is marked as community wiki

This post is a wiki. Anyone with karma >75 is welcome to improve it.

updated 2017-04-26 12:01:23 +0200

lpr gravatar image

Description

Race condition in the get_task_ioprio function in block/ioprio.c in the Linux kernel before 4.6.6 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call.

CVSS v3 Base Score: 7.8 High

This patch should fix it.

File affected: kernel-adaptation-sbj-3.4.108.20161101.1/fs/ioprio.c lines 145-152

edit retag flag offensive reopen delete

The question has been closed for the following reason "released in a software update" by lpr
close date 2017-06-14 17:56:53.204859

Comments

released in 2.1.1.12/Jämsänjoki

lpr ( 2017-06-14 17:56:41 +0200 )edit