Debian: DSA-3503-1: linux security update

    Date03 Mar 2016
    CategoryDebian
    59
    Posted ByLinuxSecurity Advisories
    Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, information leak or data loss.
    
    - -------------------------------------------------------------------------
    Debian Security Advisory DSA-3503-1                   This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.debian.org/security/                            Ben Hutchings
    March 03, 2016                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------
    
    Package        : linux
    CVE ID         : CVE-2013-4312 CVE-2015-7566 CVE-2015-8767 CVE-2015-8785
                     CVE-2015-8812 CVE-2015-8816 CVE-2015-8830 CVE-2016-0723
                     CVE-2016-0774 CVE-2016-2069 CVE-2016-2384 CVE-2016-2543
                     CVE-2016-2544 CVE-2016-2545 CVE-2016-2546 CVE-2016-2547
                     CVE-2016-2548 CVE-2016-2549 CVE-2016-2550
    
    Several vulnerabilities have been discovered in the Linux kernel that
    may lead to a privilege escalation, denial of service, information
    leak or data loss.
    
    CVE-2013-4312
    
        Tetsuo Handa discovered that users can use pipes queued on local
        (Unix) sockets to allocate an unfair share of kernel memory, leading
        to denial-of-service (resource exhaustion).
    
        This issue was previously mitigated for the stable suite by limiting
        the total number of files queued by each user on local sockets. The
        new kernel version in both suites includes that mitigation plus
        limits on the total size of pipe buffers allocated for each user.
    
    CVE-2015-7566
    
        Ralf Spenneberg of OpenSource Security reported that the visor
        driver crashes when a specially crafted USB device without bulk-out
        endpoint is detected.
    
    CVE-2015-8767
    
        An SCTP denial-of-service was discovered which can be triggered by a
        local attacker during a heartbeat timeout event after the 4-way
        handshake.
    
    CVE-2015-8785
    
        It was discovered that local users permitted to write to a file on a
        FUSE filesystem could cause a denial of service (unkillable loop in
        the kernel).
    
    CVE-2015-8812
    
        A flaw was found in the iw_cxgb3 Infiniband driver. Whenever it
        could not send a packet because the network was congested, it would
        free the packet buffer but later attempt to send the packet again.
        This use-after-free could result in a denial of service (crash or
        hang), data loss or privilege escalation.
    
    CVE-2015-8816
    
        A use-after-free vulnerability was discovered in the USB hub driver.
        This may be used by a physically present user for privilege
        escalation.
    
    CVE-2015-8830
    
        Ben Hawkes of Google Project Zero reported that the AIO interface
        permitted reading or writing 2 GiB of data or more in a single
        chunk, which could lead to an integer overflow when applied to
        certain filesystems, socket or device types. The full security
        impact has not been evaluated.
    
    CVE-2016-0723
    
        A use-after-free vulnerability was discovered in the TIOCGETD ioctl.
        A local attacker could use this flaw for denial-of-service.
    
    CVE-2016-0774
    
        It was found that the fix for CVE-2015-1805 in kernel versions older
        than Linux 3.16 did not correctly handle the case of a partially
        failed atomic read. A local, unprivileged user could use this flaw
        to crash the system or leak kernel memory to user space.
    
    CVE-2016-2069
    
        Andy Lutomirski discovered a race condition in flushing of the TLB
        when switching tasks on an x86 system. On an SMP system this could
        possibly lead to a crash, information leak or privilege escalation.
    
    CVE-2016-2384
    
        Andrey Konovalov found that a crafted USB MIDI device with an
        invalid USB descriptor could trigger a double-free. This may be used
        by a physically present user for privilege escalation.
    
    CVE-2016-2543
    
        Dmitry Vyukov found that the core sound sequencer driver (snd-seq)
        lacked a necessary check for a null pointer, allowing a user
        with access to a sound sequencer device to cause a denial-of-
        service (crash).
    
    CVE-2016-2544, CVE-2016-2546, CVE-2016-2547, CVE-2016-2548
    
        Dmitry Vyukov found various race conditions in the sound subsystem
        (ALSA)'s management of timers. A user with access to sound devices
        could use these to cause a denial-of-service (crash or hang) or
        possibly for privilege escalation.
    
    CVE-2016-2545
    
        Dmitry Vyukov found a flaw in list manipulation in the sound
        subsystem (ALSA)'s management of timers. A user with access to sound
        devices could use this to cause a denial-of-service (crash or hang)
        or possibly for privilege escalation.
    
    CVE-2016-2549
    
        Dmitry Vyukov found a potential deadlock in the sound subsystem
        (ALSA)'s use of high resolution timers. A user with access to sound
        devices could use this to cause a denial-of-service (hang).
    
    CVE-2016-2550
    
        The original mitigation of CVE-2013-4312, limiting the total number
        of files a user could queue on local sockets, was flawed. A user
        given a local socket opened by another user, for example through the
        systemd socket activation mechanism, could make use of the other
        user's quota, again leading to a denial-of-service (resource
        exhaustion). This is fixed by accounting queued files to the sender
        rather than the socket opener.
    
    For the oldstable distribution (wheezy), these problems have been fixed
    in version 3.2.73-2+deb7u3. The oldstable distribution (wheezy) is not
    affected by CVE-2015-8830.
    
    For the stable distribution (jessie), these problems have been fixed in
    version 3.16.7-ckt20-1+deb8u4. CVE-2015-7566, CVE-2015-8767 and
    CVE-2016-0723 were already fixed in DSA-3448-1. CVE-2016-0774 does not
    affect the stable distribution.
    
    We recommend that you upgrade your linux packages.
    
    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/
    
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    Do you read our distribution advisories on a regular basis?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /component/communitypolls/?task=poll.vote&format=json
    23
    radio
    [{"id":"84","title":"Yes, for a single distribution","votes":"0","type":"x","order":"1","pct":0,"resources":[]},{"id":"85","title":"Yes, for multiple distributions","votes":"6","type":"x","order":"2","pct":60,"resources":[]},{"id":"86","title":"No","votes":"4","type":"x","order":"3","pct":40,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.