CVE-2016-2069

Condición de carrera en arch/x86/mm/tlb.c en el kernel de Linux en versiones anteriores a 4.4.1 permite a usuarios locales obtener privilegios desencadenando el acceso a una estructura de paginación por un CPU diferente.

A flaw was discovered in the way the Linux kernel dealt with paging structures. When the kernel invalidated a paging structure that was not in use locally, it could, in principle, race against another CPU that is switching to a process that uses the paging structure in question. A local user could use a thread running with a stale cached virtual->physical translation to potentially escalate their privileges if the translation in question were writable and the physical page got reused for something critical (for example, a page table).