[lfs-dev] linux-4.13.7

Ken Moffat zarniwhoop at ntlworld.com
Sat Oct 14 14:37:26 PDT 2017

For anybody running a 4.13 kernel (or current 4.14-rc releases) who
has local users, 4.13.7 fixes CVE-2017-5123 : waitid() not calling

Quoting Kees Cook on oss-sec:

Chris Salls discovered that when the waitid() syscall in Linux kernel
v4.13 was refactored, it accidentally stopped checking that the
incoming argument was pointing to userspace. This allowed local
attackers to write directly to kernel memory, which could lead to
privilege escalation.

Truth, in front of her huge walk-in wardrobe, selected black leather
boots with stiletto heels for such a barefaced truth.
                                     - Unseen Academicals

More information about the lfs-dev mailing list