1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 3886-1] linux security update

    From Salvatore Bonaccorso@1:229/2 to All on Mon Jun 19 18:00:02 2017
    From: [email protected]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-3886-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso
    June 19, 2017 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : linux
    CVE ID : CVE-2017-0605 CVE-2017-7487 CVE-2017-7645 CVE-2017-7895
    CVE-2017-8064 CVE-2017-8890 CVE-2017-8924 CVE-2017-8925
    CVE-2017-9074 CVE-2017-9075 CVE-2017-9076 CVE-2017-9077
    CVE-2017-9242 CVE-2017-1000364

    Several vulnerabilities have been discovered in the Linux kernel that
    may lead to a privilege escalation, denial of service or information
    leaks.

    CVE-2017-0605

    A buffer overflow flaw was discovered in the trace subsystem.

    CVE-2017-7487

    Li Qiang reported a reference counter leak in the ipxitf_ioctl
    function which may result into a use-after-free vulnerability,
    triggerable when a IPX interface is configured.

    CVE-2017-7645

    Tuomas Haanpaa and Matti Kamunen from Synopsys Ltd discovered that
    the NFSv2 and NFSv3 server implementations are vulnerable to an
    out-of-bounds memory access issue while processing arbitrarily long
    arguments sent by NFSv2/NFSv3 PRC clients, leading to a denial of
    service.

    CVE-2017-7895

    Ari Kauppi from Synopsys Ltd discovered that the NFSv2 and NFSv3
    server implementations do not properly handle payload bounds
    checking of WRITE requests. A remote attacker with write access to a
    NFS mount can take advantage of this flaw to read chunks of
    arbitrary memory from both kernel-space and user-space.

    CVE-2017-8064

    Arnd Bergmann found that the DVB-USB core misused the device
    logging system, resulting in a use-after-free vulnerability, with
    unknown security impact.

    CVE-2017-8890

    It was discovered that the net_csk_clone_lock() function allows a
    remote attacker to cause a double free leading to a denial of
    service or potentially have other impact.

    CVE-2017-8924

    Johan Hovold found that the io_ti USB serial driver could leak
    sensitive information if a malicious USB device was connected.

    CVE-2017-8925

    Johan Hovold found a reference counter leak in the omninet USB
    serial driver, resulting in a use-after-free vulnerability. This
    can be triggered by a local user permitted to open tty devices.

    CVE-2017-9074

    Andrey Konovalov reported that the IPv6 fragmentation
    implementation could read beyond the end of a packet buffer. A
    local user or guest VM might be able to use this to leak sensitive
    information or to cause a denial of service (crash).

    CVE-2017-9075

    Andrey Konovalov reported that the SCTP/IPv6 implementation
    wrongly initialised address lists on connected sockets, resulting
    in a use-after-free vulnerability, a similar issue to
    CVE-2017-8890. This can be triggered by any local user.

    CVE-2017-9076 / CVE-2017-9077

    Cong Wang found that the TCP/IPv6 and DCCP/IPv6 implementations
    wrongly initialised address lists on connected sockets, a similar
    issue to CVE-2017-9075.

    CVE-2017-9242

    Andrey Konovalov reported a packet buffer overrun in the IPv6
    implementation. A local user could use this for denial of service
    (memory corruption; crash) and possibly for privilege escalation.

    CVE-2017-1000364

    The Qualys Research Labs discovered that the size of the stack guard
    page is not sufficiently large. The stack-pointer can jump over the
    guard-page and moving from the stack into another memory region
    without accessing the guard-page. In this case no page-fault
    exception is raised and the stack extends into the other memory
    region. An attacker can exploit this flaw for privilege escalation.

    The default stack gap protection is set to 256 pages and can be
    configured via the stack_guard_gap kernel parameter on the kernel
    command line.

    Further details can be found at
    https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt

    For the oldstable distribution (jessie), these problems have been fixed
    in version 3.16.43-2+deb8u1.

    For the stable distribution (stretch), these problems have been fixed in version 4.9.30-2+deb9u1 or earlier versions before the stretch release.

    We recommend that you upgrade your linux packages.

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: [email protected]
    -----BEGIN PGP SIGNATURE-----

    iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAllH7wxfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0R38w/+MgLDpftRSRxAsR0QMJwt89Kmp8aw4X8NnUF2epaR0gSERD45BB9iB8Em 0QsP0hPqJZwmTDelo54EOKuJjcXEtAgHBLBAJj7AvGIJz1MKiJcsUQJItVUr6itA KjJtab8IFYkXxg3aL3UiSed0+eWO+ODNuFk251/dvdYLv/IRGXfep24978ktM1mj Gykywmvr9eOaSlRfr/cHYuO6v0No5wL8OGiPM+abl9i8lN/dXxllEEQEUm+me6O6 pnrBk0bGOh3fQS/lqhiv4q/T3V5ux56jgj/iu4L3YF3Neui/oc1Ip8wTPGhj/JuJ 4rwjoHSXRSLtHHModfL3O92Atu5n74ZjpbCpZnu/BMxwcqq8NxrOpht1dbB77auM vkVtcKY7/fmlwgkbK2KQGmLmzcSxXN9GymR26DAVZbetWyLDoxkIrPJeamWK2I+T A+cDBnx2QEzXazi7H73CqLREp11AndWRIqnHs1urVfa6Q3RUQG7zwg7MCEMP0vhv qFsXLW3B6kNQPa9ptM+Y/cNHz4+5GfEI5eeoEQ4pw+4uopxRhCJwQ0/SiaSXG1vZ 2Pj9U0qOo7iDLCAKDWFDdCze4msPyOBoNKcxkbTz+EB5RQy3amXbexavjmXcWZ/4 GfRnMkwwFVlIN1rF9Vu/ehhi8iYDilL8+3gVgX2QyKlHYbS30dg=
    =cr+H
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)