USN-3161-3: Linux kernel (Raspberry Pi 2) vulnerabilities

Ubuntu Security Notice USN-3161-3

20th December, 2016

linux-raspi2 vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 16.04 LTS

Summary

Several security issues were fixed in the kernel.

Software description

• linux-raspi2
  - Linux kernel for Raspberry Pi 2
  
  

Details

Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the
TTY implementation in the Linux kernel. A local attacker could use this to
expose sensitive information (kernel memory). ()

CAI Qian discovered that shared bind mounts in a mount namespace
exponentially added entries without restriction to the Linux kernel's mount
table. A local attacker could use this to cause a denial of service (system
crash). ()

Andreas Gruenbacher and Jan Kara discovered that the filesystem
implementation in the Linux kernel did not clear the setgid bit during a
setxattr call. A local attacker could use this to possibly elevate group
privileges. ()

It was discovered that the KVM implementation for x86/x86_64 in the Linux
kernel could dereference a null pointer. An attacker in a guest virtual
machine could use this to cause a denial of service (system crash) in the
KVM host. ()

Marco Grassi discovered that the TCP implementation in the Linux kernel
mishandles socket buffer (skb) truncation. A local attacker could use this
to cause a denial of service (system crash). ()

It was discovered that an information leak existed in __get_user_asm_ex()
in the Linux kernel. A local attacker could use this to expose sensitive
information. ()

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.04 LTS:

To update your system, please follow these instructions:
,

,

,

,

,

,

CVE-2016-9555