Login
Login-Name Passwort


 
Newsletter
Werbung

Sicherheit: Mehrere Probleme in Linux
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in Linux
ID: USN-3583-1
Distribution: Ubuntu
Plattformen: Ubuntu 14.04 LTS
Datum: Fr, 23. Februar 2018, 12:04
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15868
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5754
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12192
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16525
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15274
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15102
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17450
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7889
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15115
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17806
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8824
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14140
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14156
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5669
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12190
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7542
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14051
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12153
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18017
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5333
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5344
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0861
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14489
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000407
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0750
Applikationen: Linux

Originalnachricht


--===============7429649992082486192==
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature";
boundary="j+MD90OnwjQyWNYt"
Content-Disposition: inline


--j+MD90OnwjQyWNYt
Content-Type: text/plain; charset=utf-8
Content-Disposition: inlin
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-3583-1
February 23, 2018

linux vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
- linux: Linux kernel

Details:

It was discovered that an out-of-bounds write vulnerability existed in the
Flash-Friendly File System (f2fs) in the Linux kernel. An attacker could
construct a malicious file system that, when mounted, could cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2017-0750)

It was discovered that a race condition leading to a use-after-free
vulnerability existed in the ALSA PCM subsystem of the Linux kernel. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2017-0861)

It was discovered that the KVM implementation in the Linux kernel allowed
passthrough of the diagnostic I/O port 0x80. An attacker in a guest VM
could use this to cause a denial of service (system crash) in the host OS.
(CVE-2017-1000407)

Bo Zhang discovered that the netlink wireless configuration interface in
the Linux kernel did not properly validate attributes when handling certain
requests. A local attacker with the CAP_NET_ADMIN could use this to cause a
denial of service (system crash). (CVE-2017-12153)

Vitaly Mayatskikh discovered that the SCSI subsystem in the Linux kernel
did not properly track reference counts when merging buffers. A local
attacker could use this to cause a denial of service (memory exhaustion).
(CVE-2017-12190)

It was discovered that the key management subsystem in the Linux kernel did
not properly restrict key reads on negatively instantiated keys. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2017-12192)

It was discovered that an integer overflow existed in the sysfs interface
for the QLogic 24xx+ series SCSI driver in the Linux kernel. A local
privileged attacker could use this to cause a denial of service (system
crash). (CVE-2017-14051)

Otto Ebeling discovered that the memory manager in the Linux kernel did not
properly check the effective UID in some situations. A local attacker could
use this to expose sensitive information. (CVE-2017-14140)

It was discovered that the ATI Radeon framebuffer driver in the Linux
kernel did not properly initialize a data structure returned to user space.
A local attacker could use this to expose sensitive information (kernel
memory). (CVE-2017-14156)

ChunYu Wang discovered that the iSCSI transport implementation in the Linux
kernel did not properly validate data structures. A local attacker could
use this to cause a denial of service (system crash). (CVE-2017-14489)

James Patrick-Evans discovered a race condition in the LEGO USB Infrared
Tower driver in the Linux kernel. A physically proximate attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-15102)

ChunYu Wang discovered that a use-after-free vulnerability existed in the
SCTP protocol implementation in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code, (CVE-2017-15115)

It was discovered that the key management subsystem in the Linux kernel did
not properly handle NULL payloads with non-zero length values. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2017-15274)

It was discovered that the Bluebooth Network Encapsulation Protocol (BNEP)
implementation in the Linux kernel did not validate the type of socket
passed in the BNEPCONNADD ioctl(). A local attacker with the CAP_NET_ADMIN
privilege could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2017-15868)

Andrey Konovalov discovered a use-after-free vulnerability in the USB
serial console driver in the Linux kernel. A physically proximate attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2017-16525)

It was discovered that the netfilter passive OS fingerprinting (xt_osf)
module did not properly perform access control checks. A local attacker
could improperly modify the systemwide OS fingerprint list.
(CVE-2017-17450)

It was discovered that the HMAC implementation did not validate the state
of the underlying cryptographic hash algorithm. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-17806)

Denys Fedoryshchenko discovered a use-after-free vulnerability in the
netfilter xt_TCPMSS filter of the Linux kernel. A remote attacker could use
this to cause a denial of service (system crash). (CVE-2017-18017)

Gareth Evans discovered that the shm IPC subsystem in the Linux kernel did
not properly restrict mapping page zero. A local privileged attacker could
use this to execute arbitrary code. (CVE-2017-5669)

It was discovered that an integer overflow vulnerability existing in the
IPv6 implementation in the Linux kernel. A local attacker could use this to
cause a denial of service (infinite loop). (CVE-2017-7542)

Tommi Rantala and Brad Spengler discovered that the memory manager in the
Linux kernel did not properly enforce the CONFIG_STRICT_DEVMEM protection
mechanism. A local attacker with access to /dev/mem could use this to
expose sensitive information or possibly execute arbitrary code.
(CVE-2017-7889)

Mohamed Ghannam discovered a use-after-free vulnerability in the DCCP
protocol implementation in the Linux kernel. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-8824)

Mohamed Ghannam discovered a null pointer dereference in the RDS (Reliable
Datagram Sockets) protocol implementation of the Linux kernel. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2018-5333)

范韙飞 discovered that a race condition existed in loop block device
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2018-5344)

USN-3524-1 mitigated CVE-2017-5754 (Meltdown) for the amd64
architecture in Ubuntu 14.04 LTS. This update provides the
corresponding mitigations for the ppc64el architecture. Original
advisory details:

Jann Horn discovered that microprocessors utilizing speculative execution
and indirect branch prediction may allow unauthorized memory reads via
sidechannel attacks. This flaw is known as Meltdown. A local attacker could
use this to expose sensitive information, including kernel memory.
(CVE-2017-5754)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
linux-image-3.13.0-142-generic 3.13.0-142.191
linux-image-3.13.0-142-generic-lpae 3.13.0-142.191
linux-image-3.13.0-142-lowlatency 3.13.0-142.191
linux-image-3.13.0-142-powerpc-e500 3.13.0-142.191
linux-image-3.13.0-142-powerpc-e500mc 3.13.0-142.191
linux-image-3.13.0-142-powerpc-smp 3.13.0-142.191
linux-image-3.13.0-142-powerpc64-emb 3.13.0-142.191
linux-image-3.13.0-142-powerpc64-smp 3.13.0-142.191
linux-image-generic 3.13.0.142.152
linux-image-generic-lpae 3.13.0.142.152
linux-image-lowlatency 3.13.0.142.152
linux-image-powerpc-e500 3.13.0.142.152
linux-image-powerpc-e500mc 3.13.0.142.152
linux-image-powerpc-smp 3.13.0.142.152
linux-image-powerpc64-emb 3.13.0.142.152
linux-image-powerpc64-smp 3.13.0.142.152

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://usn.ubuntu.com/usn/usn-3583-1
CVE-2017-0750, CVE-2017-0861, CVE-2017-1000407, CVE-2017-12153,
CVE-2017-12190, CVE-2017-12192, CVE-2017-14051, CVE-2017-14140,
CVE-2017-14156, CVE-2017-14489, CVE-2017-15102, CVE-2017-15115,
CVE-2017-15274, CVE-2017-15868, CVE-2017-16525, CVE-2017-17450,
CVE-2017-17806, CVE-2017-18017, CVE-2017-5669, CVE-2017-5754,
CVE-2017-7542, CVE-2017-7889, CVE-2017-8824, CVE-2018-5333,
CVE-2018-5344

Package Information:
https://launchpad.net/ubuntu/+source/linux/3.13.0-142.191


--j+MD90OnwjQyWNYt
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIcBAABCgAGBQJaj94wAAoJEC8Jno0AXoH04HgQAK8UApJjnjGfJg/KygOzbmeY
ey5XbX0UcVg9GTSj3C1LkVinmiVlE8OXTWyap/R8iZix+dAyCNmRl5Lo2rZJTHOK
WlAiI6Gsl/hPj6WzsVETCLZs+me9zI45v7jHd1nNJ8m3IV4Hw90mOORM1rxad9cu
JCi8c80q3k2WIMKljVMWxMD9qptbL6shb5aczhOiW3jSvcKLl+BRLDPccje4Crzj
iVHOsizCOO2NbcLVn6dVkgH6lRSy5QNI/q/66LzGHZO2FXIIEkK296uFDACdSpVZ
HjgGZSMZMK6JiupggSgNYCMWhQ3Qes/xBaGDJ4B0hRqfKN2IiGsLgwccF15nZ2Va
vTaHxVFN/V0hUgdk5ew2ip4Wq9VAt9Vep+DhN/oAtfgThlAhtSvFHbXLisiqMfGf
2+nvpkD7PRe//nzsyjj4ffD4WV2bq1BxCwzbHfZPOplGbghwe0NerG7CcMWNYDAo
7J+Ulw6HPFV90zBg0Bkr03N2sniFrO2SE94qwbL+tD3oqw/Pslm5ONybmyoWEKPe
9JlU3K6y1+vKbFvG+5tMqmEtrVL/AWh+JOam9NKDCYt29PfAqwEoZY9z7l2wmpDD
/HmYn30fXMCtP6S6PGdLhdvinRoUlGu9+c4/GFmHdg/6WZP/ljmOzC1l8XcSyT2U
ijIRa6otAfF/uVxIY8BD
=RJRY
-----END PGP SIGNATURE-----

--j+MD90OnwjQyWNYt--


--===============7429649992082486192==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5
LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl
IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj
dXJpdHktYW5ub3VuY2UK

--===============7429649992082486192==--
Pro-Linux
Unterstützer werden
Neue Nachrichten
Werbung