Debian LTS: DLA-1919-2: linux-4.9 security update

    Date15 Sep 2019
    CategoryDebian LTS
    2032
    Posted ByLinuxSecurity Advisories
    Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.
    Package        : linux-4.9
    Version        : 4.9.189-3~deb8u1
    CVE ID         : CVE-2019-0136 CVE-2019-9506 CVE-2019-11487 CVE-2019-15211
                     CVE-2019-15212 CVE-2019-15215 CVE-2019-15216 CVE-2019-15218
                     CVE-2019-15219 CVE-2019-15220 CVE-2019-15221 CVE-2019-15292
                     CVE-2019-15538 CVE-2019-15666 CVE-2019-15807 CVE-2019-15924
                     CVE-2019-15926
    Debian Bug     : 930904
    
    Several vulnerabilities have been discovered in the Linux kernel that
    may lead to a privilege escalation, denial of service or information
    leaks.
    
    This updated advisory text mentions the additional non-security
    changes and notes the need to install new binary packages.
    
    CVE-2019-0136
    
        It was discovered that the wifi soft-MAC implementation (mac80211)
        did not properly authenticate Tunneled Direct Link Setup (TDLS)
        messages.  A nearby attacker could use this for denial of service
        (loss of wifi connectivity).
    
    CVE-2019-9506
    
        Daniele Antonioli, Nils Ole Tippenhauer, and Kasper Rasmussen
        discovered a weakness in the Bluetooth pairing protocols, dubbed
        the "KNOB attack".  An attacker that is nearby during pairing
        could use this to weaken the encryption used between the paired
        devices, and then to eavesdrop on and/or spoof communication
        between them.
    
        This update mitigates the attack by requiring a minimum encryption
        key length of 56 bits.
    
    CVE-2019-11487
    
        Jann Horn discovered that the FUSE (Filesystem-in-Userspace)
        facility could be used to cause integer overflow in page reference
        counts, leading to a use-after-free.  On a system with sufficient
        physical memory, a local user permitted to create arbitrary FUSE
        mounts could use this for privilege escalation.
    
        By default, unprivileged users can only mount FUSE filesystems
        through fusermount, which limits the number of mounts created and
        should completely mitigate the issue.
    
    CVE-2019-15211
    
        The syzkaller tool found a bug in the radio-raremono driver that
        could lead to a use-after-free.  An attacker able to add and
        remove USB devices could use this to cause a denial of service
        (memory corruption or crash) or possibly for privilege escalation.
    
    CVE-2019-15212
    
        The syzkaller tool found that the rio500 driver does not work
        correctly if more than one device is bound to it.  An attacker
        able to add USB devices could use this to cause a denial of
        service (memory corruption or crash) or possibly for privilege
        escalation.
    
    CVE-2019-15215
    
        The syzkaller tool found a bug in the cpia2_usb driver that leads
        to a use-after-free.  An attacker able to add and remove USB
        devices could use this to cause a denial of service (memory
        corruption or crash) or possibly for privilege escalation.
    
    CVE-2019-15216
    
        The syzkaller tool found a bug in the yurex driver that leads to
        a use-after-free.  An attacker able to add and remove USB
        devices could use this to cause a denial of service (memory
        corruption or crash) or possibly for privilege escalation.
    
    CVE-2019-15218
    
        The syzkaller tool found that the smsusb driver did not validate
        that USB devices have the expected endpoints, potentially leading
        to a null pointer dereference.  An attacker able to add USB
        devices could use this to cause a denial of service (BUG/oops).
    
    CVE-2019-15219
    
        The syzkaller tool found that a device initialisation error in the
        sisusbvga driver could lead to a null pointer dereference.  An
        attacker able to add USB devices could use this to cause a denial
        of service (BUG/oops).
    
    CVE-2019-15220
    
        The syzkaller tool found a race condition in the p54usb driver
        which could lead to a use-after-free.  An attacker able to add and
        remove USB devices could use this to cause a denial of service
        (memory corruption or crash) or possibly for privilege escalation.
    
    CVE-2019-15221
    
        The syzkaller tool found that the line6 driver did not validate
        USB devices' maximum packet sizes, which could lead to a heap
        buffer overrun.  An attacker able to add USB devices could use
        this to cause a denial of service (memory corruption or crash) or
        possibly for privilege escalation.
    
    CVE-2019-15292
    
        The Hulk Robot tool found missing error checks in the Appletalk
        protocol implementation, which could lead to a use-after-free.
        The security impact of this is unclear.
    
    CVE-2019-15538
    
        Benjamin Moody reported that operations on XFS hung after a
        chgrp command failed due to a disk quota.  A local user on a
        system using XFS and disk quotas could use this for denial of
        service.
    
    CVE-2019-15666
    
        The Hulk Robot tool found an incorrect range check in the network
        transformation (xfrm) layer, leading to out-of-bounds memory
        accesses.  A local user with CAP_NET_ADMIN capability (in any user
        namespace) could use this to cause a denial of service (memory
        corruption or crash) or possibly for privilege escalation.
    
    CVE-2019-15807
    
        Jian Luo reported that the Serial Attached SCSI library (libsas)
        did not correctly handle failure to discover devices beyond a SAS
        expander.  This could lead to a resource leak and crash (BUG).
        The security impact of this is unclear.
    
    CVE-2019-15924
    
        The Hulk Robot tool found a missing error check in the fm10k
        Ethernet driver, which could lead to a null pointer dereference
        and crash (BUG/oops).  The security impact of this is unclear.
    
    CVE-2019-15926
    
        It was found that the ath6kl wifi driver did not consistently
        validate traffic class numbers in received control packets,
        leading to out-of-bounds memory accesses.  A nearby attacker on
        the same wifi network could use this to cause a denial of service
        (memory corruption or crash) or possibly for privilege escalation.
    
    For Debian 8 "Jessie", these problems have been fixed in version
    4.9.189-3~deb8u1.  This version also includes a fix for Debian bug
    #930904, and other fixes included in upstream stable updates.
    
    We recommend that you upgrade your linux-4.9 and linux-latest-4.9
    packages.  You will need to use "apt-get upgrade --with-new-pkgs"
    or "apt upgrade" as the binary package names have changed.
    
    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS
    
    -- 
    Ben Hutchings - Debian developer, member of kernel, installer and LTS teams
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"22","type":"x","order":"1","pct":55,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":12.5,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"13","type":"x","order":"3","pct":32.5,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.