VOMIT (go/vomit) has received an external vulnerability report for the Linux kernel.
Advisory: CVE-2017-10661
Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2017-10661
CVSS severity score: 7.6/10.0
Description:
Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing.
This bug was filed by http://go/vomit
Please contact us at vomit-team@google.com if you need any assistance.
Comment 1 by groeck@chromium.org
, Aug 30 2017upstream commit 1e38da300e1 ("timerfd: Protect the might cancel mechanism proper"). Already fixed in chromeos-4.4 as part of a stable tree merge and fixed in older kernels with b:64448309. Marking as WontFix since I don't know how to mark a bug as duplicate of a bug handled in buganizer.