Mehrere Probleme in Linux
ID: | USN-2491-1 |
Distribution: | Ubuntu |
Plattformen: | Ubuntu 10.04 LTS |
Datum: | Mi, 4. Februar 2015, 04:11 |
Referenzen: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3610
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3611 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8133 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9322 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9420 |
Applikationen: | Linux |
Originalnachricht |
|
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============5153048979494698294== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="eS4Feop8pJhGpJmHKmRURf7HvKNENJnmr" This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --eS4Feop8pJhGpJmHKmRURf7HvKNENJnmr Content-Type: text/plain; charset=utf- Content-Transfer-Encoding: quoted-printable ========================================================================== Ubuntu Security Notice USN-2491-1 February 04, 2015 linux-ec2 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 10.04 LTS Summary: Several security issues were fixed in the kernel. Software Description: - linux-ec2: Linux kernel for EC2 Details: Andy Lutomirski discovered that the Linux kernel does not properly handle faults associated with the Stack Segment (SS) register in the x86 architecture. A local attacker could exploit this flaw to gain administrative privileges. (CVE-2014-9322) Lars Bull reported a race condition in the PIT (programmable interrupt timer) emulation in the KVM (Kernel Virtual Machine) subsystem of the Linux kernel. A local guest user with access to PIT i/o ports could exploit this flaw to cause a denial of service (crash) on the host. (CVE-2014-3611) Lars Bull and Nadav Amit reported a flaw in how KVM (the Kernel Virtual Machine) handles noncanonical writes to certain MSR registers. A privileged guest user can exploit this flaw to cause a denial of service (kernel panic) on the host. (CVE-2014-3610) Andy Lutomirski discovered an information leak in the Linux kernel's Thread Local Storage (TLS) implementation allowing users to bypass the espfix to obtain information that could be used to bypass the Address Space Layout Randomization (ASLR) protection mechanism. A local user could exploit this flaw to obtain potentially sensitive information from kernel memory. (CVE-2014-8133) Prasad J Pandit reported a flaw in the rock_continue function of the Linux kernel's ISO 9660 CDROM file system. A local user could exploit this flaw to cause a denial of service (system crash or hang). (CVE-2014-9420) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 10.04 LTS: linux-image-2.6.32-375-ec2 2.6.32-375.92 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. If you use linux-restricted-modules, you have to update that package as well to get modules which work with the new kernel version. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-server, linux-powerpc), a standard system upgrade will automatically perform this as well. References: http://www.ubuntu.com/usn/usn-2491-1 CVE-2014-3610, CVE-2014-3611, CVE-2014-8133, CVE-2014-9322, CVE-2014-9420 Package Information: https://launchpad.net/ubuntu/+source/linux-ec2/2.6.32-375.92 --eS4Feop8pJhGpJmHKmRURf7HvKNENJnmr Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJU0XTZAAoJEAUvNnAY1cPYck4P/jsKtSr1YYBxVqBA8MTOjYwg RxgsIZuRXFZ92OPr5uEROZt9KAvyI6BbDtmsQPGmNZXapK4nO8PYKSLy/QWSdepM fVjs2V6sPz4l08/I/pj+qJ6/Uf+5OWZ2FEIfiUyAF7R9yf0kcUEeanMmYYWxZBhm WQG5DsTP00evokQfUotF2N+ZzwE/m3W4JEPVE3ClfdkOUUhMdtJRi/+kvyzZZwP7 4nTs7RTN/Vd4GpMneCZraBdlio5r7p7zYVRNVQFNlYIWYHhMLGf2KJf+o3K75+8g dXENx4/WmFj/ah2pf5fc+H/tqPnSpATJdcFpNl1ntPHa3XvAkWLZjic+1vthFXnN CWH8nq9THfv8aPLFcQvuDRb6kq2fCZzK4laxFX5EnrDQ9w3WLcbAN6Ky14FpnBzu evNUwF8Aoa3OBiIfmgvEXS/loqBqPvlWMf4GjjSmCWOj78ddtU/YAxBAbG518TZW YM8OVesNvAyEgfADsE1K5s8lToG6cESBb6N8V8rrf2LhsrIWk/wVbF0uvcCso0Ij N+XcI2cEwYnxp0Ubm3uMVMpI7vkfE1YKr1vrEFz3J0BX5vml5d39ewMecRLskV5g a7BrUFMNhmrSrqtxAGouGTXG8BMa8CvMEhknzmGZ9jd2ibIu3Ij2JGNicVPXpovu fjN1WfbCfWWrgG7h1Rem =nVQ2 -----END PGP SIGNATURE----- --eS4Feop8pJhGpJmHKmRURf7HvKNENJnmr-- --===============5153048979494698294== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce --===============5153048979494698294==-- |