Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in Linux (Aktualisierung)
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in Linux (Aktualisierung)
ID: USN-2516-3
Distribution: Ubuntu
Plattformen: Ubuntu 14.04 LTS
Datum: Mi, 4. März 2015, 10:33
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8133
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8160
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8559
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8989
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9419
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9420
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9428
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9529
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9584
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9585
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9683
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0239
Applikationen: Linux
Update von: Mehrere Probleme in Linux

Originalnachricht

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============0413083833706569008==
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature";
boundary="HgLxQS4xNte9gdD0qpfrxc2snXsd2CBgd"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--HgLxQS4xNte9gdD0qpfrxc2snXsd2CBgd
Content-Type: text/plain; charset=utf-
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-2516-3
March 04, 2015

linux vulnerabilities regression
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

USN-2516-1 introduced a regression in the Linux kernel.

Software Description:
- linux: Linux kernel

Details:

USN-2516-1 fixed vulnerabilities in the Linux kernel, and the fix in
USN-2516-2 was incomplete. There was an unrelated regression in the use of
the virtual counter (CNTVCT) on arm64 architectures.

This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)

Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information that could be used to bypass the Address Space Layout
Randomization (ASLR) protection mechanism. A local user could exploit this
flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014-8133)

A restriction bypass was discovered in iptables when conntrack rules are
specified and the conntrack protocol handler module is not loaded into the
Linux kernel. This flaw can cause the firewall rules on the system to be
bypassed when conntrack rules are used. (CVE-2014-8160)

A flaw was discovered with file renaming in the linux kernel. A local user
could exploit this flaw to cause a denial of service (deadlock and system
hang). (CVE-2014-8559)

A flaw was discovered in how supplemental group memberships are handled in
certain namespace scenarios. A local user could exploit this flaw to bypass
file permission restrictions. (CVE-2014-8989)

A flaw was discovered in how Thread Local Storage (TLS) is handled by the
task switching function in the Linux kernel for x86_64 based machines. A
local user could exploit this flaw to bypass the Address Space Layout
Radomization (ASLR) protection mechanism. (CVE-2014-9419)

Prasad J Pandit reported a flaw in the rock_continue function of the Linux
kernel's ISO 9660 CDROM file system. A local user could exploit this flaw
to cause a denial of service (system crash or hang). (CVE-2014-9420)

A flaw was discovered in the fragment handling of the B.A.T.M.A.N. Advanced
Meshing Protocol in the Linux kernel. A remote attacker could exploit this
flaw to cause a denial of service (mesh-node system crash) via fragmented
packets. (CVE-2014-9428)

A race condition was discovered in the Linux kernel's key ring. A local
user could cause a denial of service (memory corruption or panic) or
possibly have unspecified impact via the keyctl commands. (CVE-2014-9529)

A memory leak was discovered in the ISO 9660 CDROM file system when parsing
rock ridge ER records. A local user could exploit this flaw to obtain
sensitive information from kernel memory via a crafted iso9660 image.
(CVE-2014-9584)

A flaw was discovered in the Address Space Layout Randomization (ASLR) of
the Virtual Dynamically linked Shared Objects (vDSO) location. This flaw
makes it easier for a local user to bypass the ASLR protection mechanism.
(CVE-2014-9585)

Dmitry Chernenkov discovered a buffer overflow in eCryptfs' encrypted file
name decoding. A local unprivileged user could exploit this flaw to cause a
denial of service (system crash) or potentially gain administrative
privileges. (CVE-2014-9683)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
linux-image-3.13.0-46-generic 3.13.0-46.77
linux-image-3.13.0-46-generic-lpae 3.13.0-46.77
linux-image-3.13.0-46-lowlatency 3.13.0-46.77
linux-image-3.13.0-46-powerpc-e500 3.13.0-46.77
linux-image-3.13.0-46-powerpc-e500mc 3.13.0-46.77
linux-image-3.13.0-46-powerpc-smp 3.13.0-46.77
linux-image-3.13.0-46-powerpc64-emb 3.13.0-46.77
linux-image-3.13.0-46-powerpc64-smp 3.13.0-46.77

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2516-3
http://www.ubuntu.com/usn/usn-2516-1
https://launchpad.net/bugs/1427292

Package Information:
https://launchpad.net/ubuntu/+source/linux/3.13.0-46.77



--HgLxQS4xNte9gdD0qpfrxc2snXsd2CBgd
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJU9scEAAoJEAUvNnAY1cPYGLQP+wRnXvZU4tQJ3uxvJMnXlYwo
kU/LiG7QpuuiVtj1MgNGc//v+LPuUAW3JnCeu7+yWVR1CStm/yHN7ydkNzqg7R7j
JqPfPvj78rHCR4oA8AgN5/5dkTuq/QoVQyIcIz78iAVs5YI1DWu/ME1vxmLVK8rD
4ez9Vj9EsTDUmHwPpua8tZ/P5eMfcjxSqgGI7CC3UnRtsX/epg0y9/gbFm/CzveA
dbRR3iUAMm9pUpJbhxsqeFiOZO6EyfAhbrfVCOIRDcpNL0za4fxklXhap6dITEoA
QJZapkS07DbGWH/aQP4B2q1x9whqV6h6kR8W1XKZ64JHr/l6sX/uJ+FyOfrrKQlM
RDvsn9OYR/9eYjJgAC/ZPhhXe8VZz+M9gEwLiBp5F1Zhp0XrY1l/mucgzVSfFpvN
ykLM92nEag/20xIuw7a3UQOsiwY1c4KXiXg6soXrWfWPdyxqcTYQsassNsG737Om
lhPgSrdf520ZT3l92fsOh45kuEm1UOXftYpBvo0XKJbEJy/2Hr8uTnpjB8CnGfUF
+Q0VWSLik+e7mZiB1JkXd6Cie0KCf+uVOpL+2IdbghFvflM2xwxNXcmj9c7i7aeQ
WLk5DG8EtD/SknaBNiJ3hiZrs9GOcQ45YuUDkvQygUEhhMQjOOgnvNzOdbMfqHcA
yEg7TU4hV8J29ghhuXB7
=Ysu7
-----END PGP SIGNATURE-----

--HgLxQS4xNte9gdD0qpfrxc2snXsd2CBgd--


--===============0413083833706569008==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============0413083833706569008==--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung