Debian: DSA-3791-1 Critical: Linux Kernel Privilege Escalation Issues

CVE-2016-6786 / CVE-2016-6787

It was discovered that the performance events subsystem does not
properly manage locks during certain migrations, allowing a local
attacker to escalate privileges. This can be mitigated by
disabling unprivileged use of performance events:
sysctl kernel.perf_event_paranoid=3

CVE-2016-8405

Peter Pi of Trend Micro discovered that the frame buffer video
subsystem does not properly check bounds while copying color maps to
userspace, causing a heap buffer out-of-bounds read, leading to
information disclosure.

CVE-2016-9191

CAI Qian discovered that reference counting is not properly handled
within proc_sys_readdir in the sysctl implementation, allowing a
local denial of service (system hang) or possibly privilege
escalation.

CVE-2017-2583

Xiaohan Zhang reported that KVM for amd64 does not correctly
emulate loading of a null stack selector. This can be used by a
user in a guest VM for denial of service (on an Intel...