A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.
A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Util-linux | Util-linux_project | * | 2.32.1 (excluding) |
| Red Hat Enterprise Linux 6 | RedHat | coreutils-0:8.4-46.el6 | * |
| Red Hat Enterprise Linux 7 | RedHat | util-linux-0:2.23.2-33.el7_3.2 | * |
| Shadow | Ubuntu | artful | * |
| Shadow | Ubuntu | bionic | * |
| Shadow | Ubuntu | cosmic | * |
| Shadow | Ubuntu | devel | * |
| Shadow | Ubuntu | disco | * |
| Shadow | Ubuntu | precise | * |
| Shadow | Ubuntu | trusty | * |
| Shadow | Ubuntu | upstream | * |
| Shadow | Ubuntu | vivid/stable-phone-overlay | * |
| Shadow | Ubuntu | vivid/ubuntu-core | * |
| Shadow | Ubuntu | xenial | * |
| Shadow | Ubuntu | yakkety | * |
| Shadow | Ubuntu | zesty | * |
| Util-linux | Ubuntu | artful | * |
| Util-linux | Ubuntu | precise | * |
| Util-linux | Ubuntu | trusty | * |
| Util-linux | Ubuntu | upstream | * |
| Util-linux | Ubuntu | vivid/stable-phone-overlay | * |
| Util-linux | Ubuntu | vivid/ubuntu-core | * |
| Util-linux | Ubuntu | yakkety | * |
| Util-linux | Ubuntu | zesty | * |