Debian Jessie DSA-3804-1 Critical: Kernel Escalation And DoS Threats

CVE-2016-9588

Jim Mattson discovered that the KVM implementation for Intel x86
processors does not properly handle #BP and #OF exceptions in an
L2 (nested) virtual machine. A local attacker in an L2 guest VM
can take advantage of this flaw to cause a denial of service for
the L1 guest VM.

CVE-2017-2636

Alexander Popov discovered a race condition flaw in the n_hdlc
line discipline that can lead to a double free. A local
unprivileged user can take advantage of this flaw for privilege
escalation. On systems that do not already have the n_hdlc module
loaded, this can be mitigated by disabling it:
echo >> /etc/modprobe.d/disable-n_hdlc.conf install n_hdlc false

CVE-2017-5669

Gareth Evans reported that privileged users can map memory at
address 0 through the shmat() system call. This could make it
easier to exploit other kernel security vulnerabilities via a
set-UID program.

CVE-2017-5986

Alexander Popov reported a race condition in the SCTP
...