Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 507
Alerts This Week
Warning Icon 1 507

Ubuntu 10.04 LTS USN-1256-1 Moderate: Linux Kernel Memory Issues

ubuntu
Calendar Grey November 9, 2011
Scroller Ubuntu
Ubuntu Security Notice USN-1256-1 addresses critical Linux kernel vulnerabilities for privilege escalation and denial of service; users should upgrade to latest kernel versions
Several security issues were fixed in the kernel.

Summary

Several security issues were fixed in the kernel.

Software Description:

- linux-lts-backport-natty: Linux kernel backport from Natty

Details:

It was discovered that the /proc filesystem did not correctly handle

permission changes when programs executed. A local attacker could hold open

files to examine details about programs running with higher privileges,

potentially increasing the chances of exploiting additional

vulnerabilities. (CVE-2011-1020)

Vasiliy Kulikov discovered that the Bluetooth stack did not correctly clear

memory. A local attacker could exploit this to read kernel stack memory,

leading to a loss of privacy. (CVE-2011-1078)

Vasiliy Kulikov discovered that the Bluetooth stack did not correctly check

that device name strings were NULL terminated. A local attacker could

exploit this to crash the system, leading to a denial of service, or leak

contents of kernel stack memory, leading to a loss of privacy.

(CVE-2011-1079)

Vasiliy Kulikov disc...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory moderate ubuntu dos linux kernel memory issues privacy loss

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 10.04 LTS:
  linux-image-2.6.38-12-generic   2.6.38-12.51~lucid1
  linux-image-2.6.38-12-generic-pae  2.6.38-12.51~lucid1
  linux-image-2.6.38-12-server    2.6.38-12.51~lucid1
  linux-image-2.6.38-12-virtual   2.6.38-12.51~lucid1

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

https://ubuntu.com/security/notices/USN-1256-1

CVE-2011-1020, CVE-2011-1078, CVE-2011-1079, CVE-2011-1080,

CVE-2011-1093, CVE-2011-1160, CVE-2011-1180, CVE-2011-1478,

CVE-2011-1479, CVE-2011-1493, CVE-2011-1573, CVE-2011-1576,

CVE-2011-1577, CVE-2011-1581, CVE-2011-1585, CVE-2011-1767,

CVE-2011-1768, CVE-2011-1771, CVE-2011-1776, CVE-2011-1833,

CVE-2011-2183, CVE-2011-2213, CVE-2011-2479, CVE-2011-2484,

CVE-2011-2491, CVE-2011-2492, CVE-2011-2493, CVE-2011-2494,

CVE-2011-2495, CVE-2011-2496, CVE-2011-2497, CVE-2011-2517,

CVE-2011-2525, CVE-2011-2689, CVE-2011-2695, CVE-2011-2699,

CVE-2011-2700, CVE-2011-2723, CVE-2011-2905, CVE-2011-2909,

November 09, 2011

Topics%20covered

Topics Covered

security advisory moderate ubuntu dos linux kernel memory issues privacy loss

Package Information

https://launchpad.net/ubuntu/+source/linux-lts-backport-natty/2.6.38-12.51~lucid1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.