Debian: DSA-3607-1: linux security update

    Date28 Jun 2016
    CategoryDebian
    30
    Posted ByLinuxSecurity Advisories
    Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.
    
    - -------------------------------------------------------------------------
    Debian Security Advisory DSA-3607-1                   This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.debian.org/security/                     Salvatore Bonaccorso
    June 28, 2016                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------
    
    Package        : linux
    CVE ID         : CVE-2015-7515 CVE-2016-0821 CVE-2016-1237 CVE-2016-1583
                     CVE-2016-2117 CVE-2016-2143 CVE-2016-2184 CVE-2016-2185
                     CVE-2016-2186 CVE-2016-2187 CVE-2016-3070 CVE-2016-3134
                     CVE-2016-3136 CVE-2016-3137 CVE-2016-3138 CVE-2016-3140
                     CVE-2016-3156 CVE-2016-3157 CVE-2016-3672 CVE-2016-3951
                     CVE-2016-3955 CVE-2016-3961 CVE-2016-4470 CVE-2016-4482
                     CVE-2016-4485 CVE-2016-4486 CVE-2016-4565 CVE-2016-4569
                     CVE-2016-4578 CVE-2016-4580 CVE-2016-4581 CVE-2016-4805
                     CVE-2016-4913 CVE-2016-4997 CVE-2016-4998 CVE-2016-5243
                     CVE-2016-5244
    
    Several vulnerabilities have been discovered in the Linux kernel that
    may lead to a privilege escalation, denial of service or information
    leaks.
    
    CVE-2015-7515, CVE-2016-2184, CVE-2016-2185, CVE-2016-2186,
    CVE-2016-2187, CVE-2016-3136, CVE-2016-3137, CVE-2016-3138,
    CVE-2016-3140
    
        Ralf Spenneberg of OpenSource Security reported that various USB
        drivers do not sufficiently validate USB descriptors.  This
        allowed a physically present user with a specially designed USB
        device to cause a denial of service (crash).
    
    CVE-2016-0821
    
        Solar Designer noted that the list 'poisoning' feature, intended
        to mitigate the effects of bugs in list manipulation in the
        kernel, used poison values within the range of virtual addresses
        that can be allocated by user processes.
    
    CVE-2016-1237
    
        David Sinquin discovered that nfsd does not check permissions when
        setting ACLs, allowing users to grant themselves permissions to a
        file by setting the ACL.
    
    CVE-2016-1583
    
        Jann Horn of Google Project Zero reported that the eCryptfs
        filesystem could be used together with the proc filesystem to
        cause a kernel stack overflow.  If the ecryptfs-utils package is
        installed, local users could exploit this, via the
        mount.ecryptfs_private program, for denial of service (crash) or
        possibly for privilege escalation.
    
    CVE-2016-2117
    
        Justin Yackoski of Cryptonite discovered that the Atheros L2
        ethernet driver incorrectly enables scatter/gather I/O. A remote
        attacker could take advantage of this flaw to obtain potentially
        sensitive information from kernel memory.
    
    CVE-2016-2143
    
        Marcin Koscielnicki discovered that the fork implementation in the
        Linux kernel on s390 platforms mishandles the case of four
        page-table levels, which allows local users to cause a denial of
        service (system crash).
    
    CVE-2016-3070
    
        Jan Stancek of Red Hat discovered a local denial of service
        vulnerability in AIO handling.
    
    CVE-2016-3134
    
        The Google Project Zero team found that the netfilter subsystem does
        not sufficiently validate filter table entries. A user with the
        CAP_NET_ADMIN capability could use this for denial of service
        (crash) or possibly for privilege escalation. Debian disables
        unprivileged user namespaces by default, if locally enabled with the
        kernel.unprivileged_userns_clone sysctl, this allows privilege
        escalation.
    
    CVE-2016-3156
    
        Solar Designer discovered that the IPv4 implementation in the Linux
        kernel did not perform the destruction of inet device objects
        properly. An attacker in a guest OS could use this to cause a denial
        of service (networking outage) in the host OS.
    
    CVE-2016-3157 / XSA-171
    
        Andy Lutomirski discovered that the x86_64 (amd64) task switching
        implementation did not correctly update the I/O permission level
        when running as a Xen paravirtual (PV) guest.  In some
        configurations this would allow local users to cause a denial of
        service (crash) or to escalate their privileges within the guest.
    
    CVE-2016-3672
    
        Hector Marco and Ismael Ripoll noted that it was possible to disable
        Address Space Layout Randomisation (ASLR) for x86_32 (i386) programs
        by removing the stack resource limit. This made it easier for local
        users to exploit security flaws in programs that have the setuid or
        setgid flag set.
    
    CVE-2016-3951
    
        It was discovered that the cdc_ncm driver would free memory
        prematurely if certain errors occurred during its initialisation.
        This allowed a physically present user with a specially designed
        USB device to cause a denial of service (crash) or possibly to
        escalate their privileges.
    
    CVE-2016-3955
    
        Ignat Korchagin reported that the usbip subsystem did not check
        the length of data received for a USB buffer.  This allowed denial
        of service (crash) or privilege escalation on a system configured
        as a usbip client, by the usbip server or by an attacker able to
        impersonate it over the network.  A system configured as a usbip
        server might be similarly vulnerable to physically present users.
    
    CVE-2016-3961 / XSA-174
    
        Vitaly Kuznetsov of Red Hat discovered that Linux allowed the use of
        hugetlbfs on x86 (i386 and amd64) systems even when running as a Xen
        paravirtualised (PV) guest, although Xen does not support huge
        pages. This allowed users with access to /dev/hugepages to cause a
        denial of service (crash) in the guest.
    
    CVE-2016-4470
    
        David Howells of Red Hat discovered that a local user can trigger a
        flaw in the Linux kernel's handling of key lookups in the keychain
        subsystem, leading to a denial of service (crash) or possibly to
        privilege escalation.
    
    CVE-2016-4482, CVE-2016-4485, CVE-2016-4486, CVE-2016-4569,
    CVE-2016-4578, CVE-2016-4580, CVE-2016-5243, CVE-2016-5244
    
        Kangjie Lu reported that the USB devio, llc, rtnetlink, ALSA
        timer, x25, tipc, and rds facilities leaked information from the
        kernel stack.
    
    CVE-2016-4565
    
        Jann Horn of Google Project Zero reported that various components
        in the InfiniBand stack implemented unusual semantics for the
        write() operation.  On a system with InfiniBand drivers loaded,
        local users could use this for denial of service or privilege
        escalation.
    
    CVE-2016-4581
    
        Tycho Andersen discovered that in some situations the Linux kernel
        did not handle propagated mounts correctly. A local user can take
        advantage of this flaw to cause a denial of service (system crash).
    
    CVE-2016-4805
    
        Baozeng Ding discovered a use-after-free in the generic PPP layer in
        the Linux kernel. A local user can take advantage of this flaw to
        cause a denial of service (system crash), or potentially escalate
        their privileges.
    
    CVE-2016-4913
    
        Al Viro found that the ISO9660 filesystem implementation did not
        correctly count the length of certain invalid name entries.
        Reading a directory containing such name entries would leak
        information from kernel memory.  Users permitted to mount disks or
        disk images could use this to obtain sensitive information.
    
    CVE-2016-4997 / CVE-2016-4998
    
        Jesse Hertz and Tim Newsham discovered that missing input sanitising
        in Netfilter socket handling may result in denial of service. Debian
        disables unprivileged user namespaces by default, if locally enabled
        with the kernel.unprivileged_userns_clone sysctl, this also allows
        privilege escalation.
    
    For the stable distribution (jessie), these problems have been fixed in
    version 3.16.7-ckt25-2+deb8u2.
    
    We recommend that you upgrade your linux packages.
    
    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/
    
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    Do you read our distribution advisories on a regular basis?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /component/communitypolls/?task=poll.vote&format=json
    23
    radio
    [{"id":"84","title":"Yes, for a single distribution","votes":"0","type":"x","order":"1","pct":0,"resources":[]},{"id":"85","title":"Yes, for multiple distributions","votes":"6","type":"x","order":"2","pct":60,"resources":[]},{"id":"86","title":"No","votes":"4","type":"x","order":"3","pct":40,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.