Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 512
Alerts This Week
Warning Icon 1 512

Ubuntu 10.10 USN-1183-1 Critical: Multiple Kernel Flaws Exploited

ubuntu
Calendar Grey August 3, 2011
Scroller Ubuntu
A series of kernel vulnerabilities resolved through Ubuntu Security Notice USN-1184-2, targeting data leaks and preventing service disruptions.
Multiple kernel flaws have been fixed.

Summary

Multiple kernel flaws have been fixed.

Software Description:

- linux: Linux kernel

Details:

Dan Rosenberg discovered that multiple terminal ioctls did not correctly

initialize structure memory. A local attacker could exploit this to read

portions of kernel stack memory, leading to a loss of privacy.

(CVE-2010-4076, CVE-2010-4077)

Neil Horman discovered that NFSv4 did not correctly handle certain ordersof operation with ACL data. A remote attacker with access to an NFSv4 mount

could exploit this to crash the system, leading to a denial of service.

(CVE-2011-1090)

Timo Warns discovered that OSF partition parsing routines did not correctly

clear memory. A local attacker with physical access could plug in a

specially crafted block device to read kernel memory, leading to a loss of

privacy. (CVE-2011-1163)

Timo Warns discovered that the GUID partition parsing routines did not

correctly validate certain structures. A local attacker with physical

access could plug in a specially cra...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service critical kernel flaw ubuntu privacy loss

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 10.10:
  linux-image-2.6.35-30-generic   2.6.35-30.56
  linux-image-2.6.35-30-generic-pae  2.6.35-30.56
  linux-image-2.6.35-30-omap      2.6.35-30.56
  linux-image-2.6.35-30-powerpc   2.6.35-30.56
  linux-image-2.6.35-30-powerpc-smp  2.6.35-30.56
  linux-image-2.6.35-30-powerpc64-smp  2.6.35-30.56
  linux-image-2.6.35-30-server    2.6.35-30.56
  linux-image-2.6.35-30-versatile  2.6.35-30.56
  linux-image-2.6.35-30-virtual   2.6.35-30.56

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

CVE-2010-4076, CVE-2010-4077, CVE-2011-1090, CVE-2011-1163,

CVE-2011-1577, CVE-2011-1598, CVE-2011-1746

Severity
critical
Lowest
Low
Medium
High
Critical

August 03, 2011

Topics%20covered

Topics Covered

security advisory denial of service critical kernel flaw ubuntu privacy loss

Package Information

https://launchpad.net/ubuntu/+source/linux/2.6.35-30.56

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.