Sending SIGKILL to other processes with root privileges via su:
A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.(CVE-2017-2616 )
Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.
Please refer to Amazon advisory ALAS-2017-823 for affected packages and patching details, or update with your package manager.
Following are links for downloading patches to fix the vulnerabilities: