Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Ubuntu 12.04 LTS USN-1704-1 Critical: Linux Kernel Security Issues

ubuntu
Calendar Grey January 22, 2013
Scroller Ubuntu
Enhancements made to the Linux kernel on Ubuntu mitigate multiple serious vulnerabilities, featuring potential data exposure and denial-of-service threats.
Several security issues were fixed in the kernel.

Summary

Several security issues were fixed in the kernel.

Software Description:

- linux-lts-quantal: Linux kernel LTS from Quantal

Details:

Brad Spengler discovered a flaw in the Linux kernel's uname system call. An

unprivileged user could exploit this flaw to read kernel stack memory.

(CVE-2012-0957)

Jon Howell reported a flaw in the Linux kernel's KVM (Kernel-based virtual

machine) subsystem's handling of the XSAVE feature. On hosts, using qemu

userspace, without the XSAVE feature an unprivileged local attacker could

exploit this flaw to crash the system. (CVE-2012-4461)

Dmitry Monakhov reported a race condition flaw the Linux ext4 filesystem

that can expose stale data. An unprivileged user could exploit this flaw to

cause an information leak. (CVE-2012-4508)

A flaw was discovered in the Linux kernel's handling of script execution

when module loading is enabled. A local attacker could exploit this flaw to

cause a leak of kernel stack contents. (CVE-2012-4530)

...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service information leak critical kernel ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  linux-image-3.5.0-22-generic    3.5.0-22.34~precise1

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

CVE-2012-0957, CVE-2012-4461, CVE-2012-4508, CVE-2012-4530,

CVE-2012-4565, CVE-2012-5517, CVE-2012-5532

Severity
critical
Lowest
Low
Medium
High
Critical

January 22, 2013

Topics%20covered

Topics Covered

security advisory denial of service information leak critical kernel ubuntu

Package Information

https://launchpad.net/ubuntu/+source/linux-lts-quantal/3.5.0-22.34~precise1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.