Debian: LTS DLA-1392-1 Moderate: Kernel Denial Of Service Issues

debian lts

June 1, 2018

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service

Topics Covered

security advisory denial of service security issue Debian Linux kernel

Summary

Wen Xu reported that a crafted ext4 filesystem image could trigger
an out-of-bounds read in the ext4_valid_block_bitmap() function. A
local user able to mount arbitrary filesystems could use this for
denial of service.

CVE-2018-1130

The syzbot software found that the DCCP implementation of
sendmsg() does not check the socket state, potentially leading
to a null pointer dereference. A local user could use this to
cause a denial of service (crash).

CVE-2018-8897

Nick Peterson of Everdox Tech LLC discovered that #DB exceptions
that are deferred by MOV SS or POP SS are not properly handled,
allowing an unprivileged user to crash the kernel and cause a
denial of service.

CVE-2018-10940

Dan Carpenter reported that the cdrom driver does not correctly
validate the parameter to the CDROM_MEDIA_CHANGED ioctl. A user
with access to a cdrom device could use this to cause a denial of
service (crash).