Description
A missing authorization check in the fscrypt_process_policy function in fs/crypto/policy.c in the ext4 and f2fs filesystem encryption support in the Linux kernel before 4.7.4 allows a user to assign an encryption policy to a directory owned by a different user, potentially creating a denial of service.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 4.7.4-1 | — |
| Debian 13 | linux | 4.7.4-1 | — |
| Debian 12 | linux | 4.7.4-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux | 4.4.0-47.68 | — |
| Ubuntu 16.04 LTS | linux-raspi2 | 4.4.0-1038.45 | — |
| Ubuntu 16.04 LTS | linux-snapdragon | 4.4.0-1035.39 | — |
| Ubuntu 14.04 LTS | linux-lts-xenial | 4.4.0-47.68~14.04.1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | kernel-uek +5 | 4.1.12-112.14.1.el7uek | ELSA-2017-3659 |
Advisories 1
- ELSA-2017-3659 Important: Unbreakable Enterprise kernel security and bugfix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 13, 2017