Debian: DSA-3886-1: linux security update

    Date19 Jun 2017
    CategoryDebian
    100
    Posted ByLinuxSecurity Advisories
    Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.
    
    - -------------------------------------------------------------------------
    Debian Security Advisory DSA-3886-1                   This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.debian.org/security/                     Salvatore Bonaccorso
    June 19, 2017                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------
    
    Package        : linux
    CVE ID         : CVE-2017-0605 CVE-2017-7487 CVE-2017-7645 CVE-2017-7895 
                     CVE-2017-8064 CVE-2017-8890 CVE-2017-8924 CVE-2017-8925 
                     CVE-2017-9074 CVE-2017-9075 CVE-2017-9076 CVE-2017-9077 
                     CVE-2017-9242 CVE-2017-1000364
    
    Several vulnerabilities have been discovered in the Linux kernel that
    may lead to a privilege escalation, denial of service or information
    leaks.
    
    CVE-2017-0605
    
        A buffer overflow flaw was discovered in the trace subsystem.
    
    CVE-2017-7487
    
        Li Qiang reported a reference counter leak in the ipxitf_ioctl
        function which may result into a use-after-free vulnerability,
        triggerable when a IPX interface is configured.
    
    CVE-2017-7645
    
        Tuomas Haanpaa and Matti Kamunen from Synopsys Ltd discovered that
        the NFSv2 and NFSv3 server implementations are vulnerable to an
        out-of-bounds memory access issue while processing arbitrarily long
        arguments sent by NFSv2/NFSv3 PRC clients, leading to a denial of
        service.
    
    CVE-2017-7895
    
        Ari Kauppi from Synopsys Ltd discovered that the NFSv2 and NFSv3
        server implementations do not properly handle payload bounds
        checking of WRITE requests. A remote attacker with write access to a
        NFS mount can take advantage of this flaw to read chunks of
        arbitrary memory from both kernel-space and user-space.
    
    CVE-2017-8064
    
        Arnd Bergmann found that the DVB-USB core misused the device
        logging system, resulting in a use-after-free vulnerability, with
        unknown security impact.
    
    CVE-2017-8890
    
        It was discovered that the net_csk_clone_lock() function allows a
        remote attacker to cause a double free leading to a denial of
        service or potentially have other impact.
    
    CVE-2017-8924
    
        Johan Hovold found that the io_ti USB serial driver could leak
        sensitive information if a malicious USB device was connected.
    
    CVE-2017-8925
    
        Johan Hovold found a reference counter leak in the omninet USB
        serial driver, resulting in a use-after-free vulnerability.  This
        can be triggered by a local user permitted to open tty devices.
    
    CVE-2017-9074
    
        Andrey Konovalov reported that the IPv6 fragmentation
        implementation could read beyond the end of a packet buffer.  A
        local user or guest VM might be able to use this to leak sensitive
        information or to cause a denial of service (crash).
    
    CVE-2017-9075
    
        Andrey Konovalov reported that the SCTP/IPv6 implementation
        wrongly initialised address lists on connected sockets, resulting
        in a use-after-free vulnerability, a similar issue to
        CVE-2017-8890.  This can be triggered by any local user.
    
    CVE-2017-9076 / CVE-2017-9077
    
        Cong Wang found that the TCP/IPv6 and DCCP/IPv6 implementations
        wrongly initialised address lists on connected sockets, a similar
        issue to CVE-2017-9075.
    
    CVE-2017-9242
    
        Andrey Konovalov reported a packet buffer overrun in the IPv6
        implementation.  A local user could use this for denial of service
        (memory corruption; crash) and possibly for privilege escalation.
    
    CVE-2017-1000364
    
        The Qualys Research Labs discovered that the size of the stack guard
        page is not sufficiently large. The stack-pointer can jump over the
        guard-page and moving from the stack into another memory region
        without accessing the guard-page. In this case no page-fault
        exception is raised and the stack extends into the other memory
        region. An attacker can exploit this flaw for privilege escalation.
    
        The default stack gap protection is set to 256 pages and can be
        configured via the stack_guard_gap kernel parameter on the kernel
        command line.
    
        Further details can be found at
        https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
    
    For the oldstable distribution (jessie), these problems have been fixed
    in version 3.16.43-2+deb8u1.
    
    For the stable distribution (stretch), these problems have been fixed in
    version 4.9.30-2+deb9u1 or earlier versions before the stretch release.
    
    We recommend that you upgrade your linux packages.
    
    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/
    
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"65","type":"x","order":"1","pct":57.52,"resources":[]},{"id":"88","title":"Should be more technical","votes":"15","type":"x","order":"2","pct":13.27,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"33","type":"x","order":"3","pct":29.2,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.