1. Server >
  2. Unix Server >
  3. USN-3583-1: Linux kernel vulnerabilities


ArabicEnglishFrenchGermanGreekItalianJapaneseKoreanPersianPolishPortugueseRussianSpanishTurkishVietnamese

USN-3583-1: Linux kernel vulnerabilities

RSS Kategorie Pfeil Unix Server vom | Quelle: ubuntu.com Direktlink öffnen

Ubuntu Security Notice USN-3583-1

23rd February, 2018

linux vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in the Linux kernel.

Software description

  • linux - Linux kernel

Details

It was discovered that an out-of-bounds write vulnerability existed in the
Flash-Friendly File System (f2fs) in the Linux kernel. An attacker could
construct a malicious file system that, when mounted, could cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2017-0750)

It was discovered that a race condition leading to a use-after-free
vulnerability existed in the ALSA PCM subsystem of the Linux kernel. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2017-0861)

It was discovered that the KVM implementation in the Linux kernel allowed
passthrough of the diagnostic I/O port 0x80. An attacker in a guest VM
could use this to cause a denial of service (system crash) in the host OS.
(CVE-2017-1000407)

Bo Zhang discovered that the netlink wireless configuration interface in
the Linux kernel did not properly validate attributes when handling certain
requests. A local attacker with the CAP_NET_ADMIN could use this to cause a
denial of service (system crash). (CVE-2017-12153)

Vitaly Mayatskikh discovered that the SCSI subsystem in the Linux kernel
did not properly track reference counts when merging buffers. A local
attacker could use this to cause a denial of service (memory exhaustion).
(CVE-2017-12190)

It was discovered that the key management subsystem in the Linux kernel did
not properly restrict key reads on negatively instantiated keys. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2017-12192)

It was discovered that an integer overflow existed in the sysfs interface
for the QLogic 24xx+ series SCSI driver in the Linux kernel. A local
privileged attacker could use this to cause a denial of service (system
crash). (CVE-2017-14051)

Otto Ebeling discovered that the memory manager in the Linux kernel did not
properly check the effective UID in some situations. A local attacker could
use this to expose sensitive information. (CVE-2017-14140)

It was discovered that the ATI Radeon framebuffer driver in the Linux
kernel did not properly initialize a data structure returned to user space.
A local attacker could use this to expose sensitive information (kernel
memory). (CVE-2017-14156)

ChunYu Wang discovered that the iSCSI transport implementation in the Linux
kernel did not properly validate data structures. A local attacker could
use this to cause a denial of service (system crash). (CVE-2017-14489)

James Patrick-Evans discovered a race condition in the LEGO USB Infrared
Tower driver in the Linux kernel. A physically proximate attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-15102)

ChunYu Wang discovered that a use-after-free vulnerability existed in the
SCTP protocol implementation in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code, (CVE-2017-15115)

It was discovered that the key management subsystem in the Linux kernel did
not properly handle NULL payloads with non-zero length values. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2017-15274)

It was discovered that the Bluebooth Network Encapsulation Protocol (BNEP)
implementation in the Linux kernel did not validate the type of socket
passed in the BNEPCONNADD ioctl(). A local attacker with the CAP_NET_ADMIN
privilege could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2017-15868)

Andrey Konovalov discovered a use-after-free vulnerability in the USB
serial console driver in the Linux kernel. A physically proximate attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2017-16525)

It was discovered that the netfilter passive OS fingerprinting (xt_osf)
module did not properly perform access control checks. A local attacker
could improperly modify the systemwide OS fingerprint list.
(CVE-2017-17450)

It was discovered that the HMAC implementation did not validate the state
of the underlying cryptographic hash algorithm. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-17806)

Denys Fedoryshchenko discovered a use-after-free vulnerability in the
netfilter xt_TCPMSS filter of the Linux kernel. A remote attacker could use
this to cause a denial of service (system crash). (CVE-2017-18017)

Gareth Evans discovered that the shm IPC subsystem in the Linux kernel did
not properly restrict mapping page zero. A local privileged attacker could
use this to execute arbitrary code. (CVE-2017-5669)

It was discovered that an integer overflow vulnerability existing in the
IPv6 implementation in the Linux kernel. A local attacker could use this to
cause a denial of service (infinite loop). (CVE-2017-7542)

Tommi Rantala and Brad Spengler discovered that the memory manager in the
Linux kernel did not properly enforce the CONFIG_STRICT_DEVMEM protection
mechanism. A local attacker with access to /dev/mem could use this to
expose sensitive information or possibly execute arbitrary code.
(CVE-2017-7889)

Mohamed Ghannam discovered a use-after-free vulnerability in the DCCP
protocol implementation in the Linux kernel. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-8824)

Mohamed Ghannam discovered a null pointer dereference in the RDS (Reliable
Datagram Sockets) protocol implementation of the Linux kernel. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2018-5333)

范龙飞 discovered that a race condition existed in loop block device
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2018-5344)

USN-3524-1 mitigated CVE-2017-5754 (Meltdown) for the amd64
architecture in Ubuntu 14.04 LTS. This update provides the
corresponding mitigations for the ppc64el architecture. Original
advisory details:

Jann Horn discovered that microprocessors utilizing speculative execution
and indirect branch prediction may allow unauthorized memory reads via
sidechannel attacks. This flaw is known as Meltdown. A local attacker could
use this to expose sensitive information, including kernel memory.
(CVE-2017-5754)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 14.04 LTS:
linux-image-3.13.0-142-powerpc-smp 3.13.0-142.191
linux-image-powerpc-smp 3.13.0.142.152
linux-image-powerpc-e500mc 3.13.0.142.152
linux-image-generic 3.13.0.142.152
linux-image-3.13.0-142-powerpc64-emb 3.13.0-142.191
linux-image-3.13.0-142-powerpc64-smp 3.13.0-142.191
linux-image-powerpc64-emb 3.13.0.142.152
linux-image-3.13.0-142-generic 3.13.0-142.191
linux-image-generic-lpae 3.13.0.142.152
linux-image-powerpc-e500 3.13.0.142.152
linux-image-powerpc64-smp 3.13.0.142.152
linux-image-3.13.0-142-generic-lpae 3.13.0-142.191
linux-image-3.13.0-142-powerpc-e500mc 3.13.0-142.191
linux-image-3.13.0-142-powerpc-e500 3.13.0-142.191
linux-image-lowlatency 3.13.0.142.152
linux-image-3.13.0-142-lowlatency 3.13.0-142.191

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References

CVE-2017-0750, CVE-2017-0861, CVE-2017-1000407, CVE-2017-12153, CVE-2017-12190, CVE-2017-12192, CVE-2017-14051, CVE-2017-14140, CVE-2017-14156, CVE-2017-14489, CVE-2017-15102, CVE-2017-15115, CVE-2017-15274, CVE-2017-15868, CVE-2017-16525, CVE-2017-17450, CVE-2017-17806, CVE-2017-18017, CVE-2017-5669, CVE-2017-5754, CVE-2017-7542, CVE-2017-7889, CVE-2017-8824, CVE-2018-5333, CVE-2018-5344

...

Webseite öffnen Komplette Webseite öffnen

Newsbewertung

Kommentiere zu USN-3583-1: Linux kernel vulnerabilities






Ähnliche Beiträge

  • 1. USN-4041-1: Linux kernel update vom 402.3 Punkte ic_school_black_18dp
    linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon update A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 19.04 Ubuntu 18.10 Ubunt
  • 2. USN-4017-1: Linux kernel vulnerabilities vom 364.12 Punkte ic_school_black_18dp
    linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 19.04 Ubuntu 18.10 Ubunt
  • 3. USN-3619-1: Linux kernel vulnerabilities vom 271.97 Punkte ic_school_black_18dp
    linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.04 LTS Summary Several security issues were fixed in the Linux kernel. Software Description li
  • 4. USN-3361-1: Linux kernel (HWE) vulnerabilities vom 261.29 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-3361-1 21st July, 2017 linux-hwe vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.04 LTS Summary Several security issues were fixed in the Linux kernel. Software descriptio
  • 5. USN-3256-1: Linux kernel vulnerability vom 248.9 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-3256-1 4th April, 2017 linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon, linux-ti-omap4 vulnerability A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.10 Ubuntu 16.04 LTS Ubuntu 14.04 LTS
  • 6. USN-3328-1: Linux kernel vulnerabilities vom 248.77 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-3328-1 19th June, 2017 linux, linux-meta vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.04 LTS Summary Several security issues were fixed in the Linux kernel. Software descriptio
  • 7. USN-3583-1: Linux kernel vulnerabilities vom 217.61 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-3583-1 23rd February, 2018 linux vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.04 LTS Summary Several security issues were fixed in the Linux kernel. Software descriptio
  • 8. USN-3583-2: Linux kernel (Trusty HWE) vulnerabilities vom 200.73 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-3583-2 23rd February, 2018 linux-lts-trusty vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.04 LTS Summary Several security issues were fixed in the Linux kernel. Software descriptio
  • 9. USN-3344-1: Linux kernel vulnerabilities vom 184.39 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-3344-1 29th June, 2017 linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.04 LTS Summary Several security issues were f
  • 10. USN-3617-2: Linux (HWE) vulnerabilities vom 184.07 Punkte ic_school_black_18dp
    linux-hwe, linux-gcp, linux-oem vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.04 LTS Summary Several security issues were fixed in the Linux kernel. Software Description linux-gcp - Linux kernel for Google Cloud
  • 11. USN-3392-1: Linux kernel regression vom 182.2 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-3392-1 16th August, 2017 linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon regression A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.04 LTS Summary USN-3378-1 introduced a regres
  • 12. USN-3335-1: Linux kernel vulnerabilities vom 181.04 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-3335-1 19th June, 2017 linux, linux-meta vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.04 LTS Summary Several security issues were fixed in the Linux kernel. Software descriptio