ID

VAR-201406-0230

CVE

CVE-2014-4027

TITLE

Linux kernel of drivers/target/target_core_rd.c Inside rd_build_device_space Vulnerabilities that capture important information in functions

DESCRIPTION

The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator. Linux Kernel is prone to an information-disclosure vulnerability. An attacker can exploit this issue to obtain sensitive information; information obtained may aid in other attacks. Linux Kernel 2.6.38 through versions prior to 3.14 are affected. The NFSv4 implementation is one of the distributed file system protocols. The vulnerability is due to the fact that the program does not initialize the data structure correctly. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2014:155 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : kernel Date : August 7, 2014 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Multiple vulnerabilities has been found and corrected in the Linux kernel: Multiple buffer overflows in drivers/staging/wlags49_h2/wl_priv.c in the Linux kernel before 3.12 allow local users to cause a denial of service or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability and providing a long station-name string, related to the (1) wvlan_uil_put_info and (2) wvlan_set_station_nickname functions (CVE-2013-4514). The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls (CVE-2014-4699). The verification of md5 checksums and GPG signatures is performed automatically for you. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFT4yfXmqjQ0CJFipgRAuk5AKDbuUKogDrhb4iKIs1yOP4IQdpAcwCgodf8 OMQTfJFCDxSAMSI8iUevOkc= =mxBf -----END PGP SIGNATURE----- . (CVE-2014-4943) Michael S. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2014:1971-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-1971.html Issue date: 2014-12-09 CVE Names: CVE-2013-2929 CVE-2014-1739 CVE-2014-3181 CVE-2014-3182 CVE-2014-3184 CVE-2014-3185 CVE-2014-3186 CVE-2014-3631 CVE-2014-3673 CVE-2014-3687 CVE-2014-3688 CVE-2014-4027 CVE-2014-4652 CVE-2014-4654 CVE-2014-4655 CVE-2014-4656 CVE-2014-5045 CVE-2014-6410 ===================================================================== 1. Summary: Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - noarch, x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - noarch, x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - noarch, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - noarch, x86_64 3. Description: * A flaw was found in the way the Linux kernel's SCTP implementation handled malformed or duplicate Address Configuration Change Chunks (ASCONF). A remote attacker could use either of these flaws to crash the system. (CVE-2014-3673, CVE-2014-3687, Important) * A flaw was found in the way the Linux kernel's SCTP implementation handled the association's output queue. A remote attacker could send specially crafted packets that would cause the system to use an excessive amount of memory, leading to a denial of service. (CVE-2014-3688, Important) * Two flaws were found in the way the Apple Magic Mouse/Trackpad multi-touch driver and the Minibox PicoLCD driver handled invalid HID reports. An attacker with physical access to the system could use these flaws to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-3181, CVE-2014-3186, Moderate) * A memory corruption flaw was found in the way the USB ConnectTech WhiteHEAT serial driver processed completion commands sent via USB Request Blocks buffers. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-3185, Moderate) * A flaw was found in the way the Linux kernel's keys subsystem handled the termination condition in the associative array garbage collection functionality. A local, unprivileged user could use this flaw to crash the system. (CVE-2014-3631, Moderate) * Multiple flaws were found in the way the Linux kernel's ALSA implementation handled user controls. A local, privileged user could use either of these flaws to crash the system. (CVE-2014-4654, CVE-2014-4655, CVE-2014-4656, Moderate) * A flaw was found in the way the Linux kernel's VFS subsystem handled reference counting when performing unmount operations on symbolic links. A local, unprivileged user could use this flaw to exhaust all available memory on the system or, potentially, trigger a use-after-free error, resulting in a system crash or privilege escalation. (CVE-2014-5045, Moderate) * A flaw was found in the way the get_dumpable() function return value was interpreted in the ptrace subsystem of the Linux kernel. When 'fs.suid_dumpable' was set to 2, a local, unprivileged local user could use this flaw to bypass intended ptrace restrictions and obtain potentially sensitive information. (CVE-2013-2929, Low) * A stack overflow flaw caused by infinite recursion was found in the way the Linux kernel's UDF file system implementation processed indirect ICBs. An attacker with physical access to the system could use a specially crafted UDF image to crash the system. (CVE-2014-1739, Low) * An out-of-bounds read flaw in the Logitech Unifying receiver driver could allow an attacker with physical access to the system to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-3182, Low) * Multiple out-of-bounds write flaws were found in the way the Cherry Cymotion keyboard driver, KYE/Genius device drivers, Logitech device drivers, Monterey Genius KB29E keyboard driver, Petalynx Maxter remote control driver, and Sunplus wireless desktop driver handled invalid HID reports. An attacker with physical access to the system could use either of these flaws to write data past an allocated memory buffer. (CVE-2014-3184, Low) * An information leak flaw was found in the RAM Disks Memory Copy (rd_mcp) back end driver of the iSCSI Target subsystem could allow a privileged user to leak the contents of kernel memory to an iSCSI initiator remote client. (CVE-2014-4652, Low) 4. Solution: Red Hat would like to thank Frey Alfredsson for reporting CVE-2014-3631, and Vasily Averin of Parallels for reporting CVE-2014-5045. The CVE-2014-3673 was discovered by Liu Wei of Red Hat. All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect. Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 To install kernel packages manually, use "rpm -ivh [package]". Do not use "rpm -Uvh" as that will remove the running kernel binaries from your system. You may use "rpm -e" to remove old kernels after determining that the new kernel functions properly on your system. 5. Bugs fixed (https://bugzilla.redhat.com/): 1028148 - CVE-2013-2929 kernel: exec/ptrace: get_dumpable() incorrect tests 1108744 - CVE-2014-4027 Kernel: target/rd: imformation leakage 1109774 - CVE-2014-1739 Kernel: drivers: media: an information leakage 1113406 - CVE-2014-4652 Kernel: ALSA: control: protect user controls against races & memory disclosure 1113445 - CVE-2014-4654 CVE-2014-4655 Kernel: ALSA: control: use-after-free in replacing user controls 1113470 - CVE-2014-4656 Kernel: ALSA: control: integer overflow in id.index & id.numid 1122472 - CVE-2014-5045 kernel: vfs: refcount issues during unmount on symlink 1140325 - CVE-2014-3631 kernel: keys: incorrect termination condition in assoc array garbage collection 1141173 - CVE-2014-3181 Kernel: HID: OOB write in magicmouse driver 1141210 - CVE-2014-3182 Kernel: HID: logitech-dj OOB array access 1141391 - CVE-2014-3184 Kernel: HID: off by one error in various _report_fixup routines 1141400 - CVE-2014-3185 Kernel: USB serial: memory corruption flaw 1141407 - CVE-2014-3186 Kernel: HID: memory corruption via OOB write 1141809 - CVE-2014-6410 kernel: udf: Avoid infinite loop when processing indirect ICBs 1147850 - CVE-2014-3673 kernel: sctp: skb_over_panic when receiving malformed ASCONF chunks 1155731 - CVE-2014-3687 kernel: net: sctp: fix panic on duplicate ASCONF chunks 1155745 - CVE-2014-3688 kernel: net: sctp: remote memory pressure from excessive queueing 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: kernel-3.10.0-123.13.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-123.13.1.el7.noarch.rpm x86_64: kernel-3.10.0-123.13.1.el7.x86_64.rpm kernel-debug-3.10.0-123.13.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-123.13.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-123.13.1.el7.x86_64.rpm kernel-devel-3.10.0-123.13.1.el7.x86_64.rpm kernel-headers-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-123.13.1.el7.x86_64.rpm perf-3.10.0-123.13.1.el7.x86_64.rpm perf-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): noarch: kernel-doc-3.10.0-123.13.1.el7.noarch.rpm x86_64: kernel-debug-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-123.13.1.el7.x86_64.rpm perf-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm python-perf-3.10.0-123.13.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: kernel-3.10.0-123.13.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-123.13.1.el7.noarch.rpm x86_64: kernel-3.10.0-123.13.1.el7.x86_64.rpm kernel-debug-3.10.0-123.13.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-123.13.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-123.13.1.el7.x86_64.rpm kernel-devel-3.10.0-123.13.1.el7.x86_64.rpm kernel-headers-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-123.13.1.el7.x86_64.rpm perf-3.10.0-123.13.1.el7.x86_64.rpm perf-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): noarch: kernel-doc-3.10.0-123.13.1.el7.noarch.rpm x86_64: kernel-debug-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-123.13.1.el7.x86_64.rpm perf-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm python-perf-3.10.0-123.13.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: kernel-3.10.0-123.13.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-123.13.1.el7.noarch.rpm ppc64: kernel-3.10.0-123.13.1.el7.ppc64.rpm kernel-bootwrapper-3.10.0-123.13.1.el7.ppc64.rpm kernel-debug-3.10.0-123.13.1.el7.ppc64.rpm kernel-debug-debuginfo-3.10.0-123.13.1.el7.ppc64.rpm kernel-debug-devel-3.10.0-123.13.1.el7.ppc64.rpm kernel-debuginfo-3.10.0-123.13.1.el7.ppc64.rpm kernel-debuginfo-common-ppc64-3.10.0-123.13.1.el7.ppc64.rpm kernel-devel-3.10.0-123.13.1.el7.ppc64.rpm kernel-headers-3.10.0-123.13.1.el7.ppc64.rpm kernel-tools-3.10.0-123.13.1.el7.ppc64.rpm kernel-tools-debuginfo-3.10.0-123.13.1.el7.ppc64.rpm kernel-tools-libs-3.10.0-123.13.1.el7.ppc64.rpm perf-3.10.0-123.13.1.el7.ppc64.rpm perf-debuginfo-3.10.0-123.13.1.el7.ppc64.rpm python-perf-debuginfo-3.10.0-123.13.1.el7.ppc64.rpm s390x: kernel-3.10.0-123.13.1.el7.s390x.rpm kernel-debug-3.10.0-123.13.1.el7.s390x.rpm kernel-debug-debuginfo-3.10.0-123.13.1.el7.s390x.rpm kernel-debug-devel-3.10.0-123.13.1.el7.s390x.rpm kernel-debuginfo-3.10.0-123.13.1.el7.s390x.rpm kernel-debuginfo-common-s390x-3.10.0-123.13.1.el7.s390x.rpm kernel-devel-3.10.0-123.13.1.el7.s390x.rpm kernel-headers-3.10.0-123.13.1.el7.s390x.rpm kernel-kdump-3.10.0-123.13.1.el7.s390x.rpm kernel-kdump-debuginfo-3.10.0-123.13.1.el7.s390x.rpm kernel-kdump-devel-3.10.0-123.13.1.el7.s390x.rpm perf-3.10.0-123.13.1.el7.s390x.rpm perf-debuginfo-3.10.0-123.13.1.el7.s390x.rpm python-perf-debuginfo-3.10.0-123.13.1.el7.s390x.rpm x86_64: kernel-3.10.0-123.13.1.el7.x86_64.rpm kernel-debug-3.10.0-123.13.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-123.13.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-123.13.1.el7.x86_64.rpm kernel-devel-3.10.0-123.13.1.el7.x86_64.rpm kernel-headers-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-123.13.1.el7.x86_64.rpm perf-3.10.0-123.13.1.el7.x86_64.rpm perf-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): noarch: kernel-doc-3.10.0-123.13.1.el7.noarch.rpm ppc64: kernel-debug-debuginfo-3.10.0-123.13.1.el7.ppc64.rpm kernel-debuginfo-3.10.0-123.13.1.el7.ppc64.rpm kernel-debuginfo-common-ppc64-3.10.0-123.13.1.el7.ppc64.rpm kernel-tools-debuginfo-3.10.0-123.13.1.el7.ppc64.rpm kernel-tools-libs-devel-3.10.0-123.13.1.el7.ppc64.rpm perf-debuginfo-3.10.0-123.13.1.el7.ppc64.rpm python-perf-3.10.0-123.13.1.el7.ppc64.rpm python-perf-debuginfo-3.10.0-123.13.1.el7.ppc64.rpm s390x: kernel-debug-debuginfo-3.10.0-123.13.1.el7.s390x.rpm kernel-debuginfo-3.10.0-123.13.1.el7.s390x.rpm kernel-debuginfo-common-s390x-3.10.0-123.13.1.el7.s390x.rpm kernel-kdump-debuginfo-3.10.0-123.13.1.el7.s390x.rpm perf-debuginfo-3.10.0-123.13.1.el7.s390x.rpm python-perf-3.10.0-123.13.1.el7.s390x.rpm python-perf-debuginfo-3.10.0-123.13.1.el7.s390x.rpm x86_64: kernel-debug-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-123.13.1.el7.x86_64.rpm perf-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm python-perf-3.10.0-123.13.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: kernel-3.10.0-123.13.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-123.13.1.el7.noarch.rpm x86_64: kernel-3.10.0-123.13.1.el7.x86_64.rpm kernel-debug-3.10.0-123.13.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-123.13.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-123.13.1.el7.x86_64.rpm kernel-devel-3.10.0-123.13.1.el7.x86_64.rpm kernel-headers-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-123.13.1.el7.x86_64.rpm perf-3.10.0-123.13.1.el7.x86_64.rpm perf-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): noarch: kernel-doc-3.10.0-123.13.1.el7.noarch.rpm x86_64: kernel-debug-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-123.13.1.el7.x86_64.rpm perf-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm python-perf-3.10.0-123.13.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-123.13.1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2013-2929 https://access.redhat.com/security/cve/CVE-2014-1739 https://access.redhat.com/security/cve/CVE-2014-3181 https://access.redhat.com/security/cve/CVE-2014-3182 https://access.redhat.com/security/cve/CVE-2014-3184 https://access.redhat.com/security/cve/CVE-2014-3185 https://access.redhat.com/security/cve/CVE-2014-3186 https://access.redhat.com/security/cve/CVE-2014-3631 https://access.redhat.com/security/cve/CVE-2014-3673 https://access.redhat.com/security/cve/CVE-2014-3687 https://access.redhat.com/security/cve/CVE-2014-3688 https://access.redhat.com/security/cve/CVE-2014-4027 https://access.redhat.com/security/cve/CVE-2014-4652 https://access.redhat.com/security/cve/CVE-2014-4654 https://access.redhat.com/security/cve/CVE-2014-4655 https://access.redhat.com/security/cve/CVE-2014-4656 https://access.redhat.com/security/cve/CVE-2014-5045 https://access.redhat.com/security/cve/CVE-2014-6410 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUh2CJXlSAg2UNWIIRArzSAJ95AhqaUI998VyNBJGQaTXfSHeJuQCdFjTp 6IsJOT0XYi+TiyneMDOm9f4= =a0Ai -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Relevant releases/architectures: MRG Realtime for RHEL 6 Server v.2 - noarch, x86_64 3. (CVE-2014-3153, Important) * It was found that the Linux kernel's ptrace subsystem allowed a traced process' instruction pointer to be set to a non-canonical memory address without forcing the non-sysret code path when returning to user space. (CVE-2014-4699, Important) Note: The CVE-2014-4699 issue only affected systems using an Intel CPU. * It was found that the permission checks performed by the Linux kernel when a netlink message was received were not sufficient. (CVE-2014-0181, Moderate) * It was found that the aio_read_events_ring() function of the Linux kernel's Asynchronous I/O (AIO) subsystem did not properly sanitize the AIO ring head received from user space. (CVE-2014-0206, Moderate) * An out-of-bounds memory access flaw was found in the Netlink Attribute extension of the Berkeley Packet Filter (BPF) interpreter functionality in the Linux kernel's networking implementation. Google acknowledges Pinkie Pie as the original reporter of CVE-2014-3153. Bugs fixed (https://bugzilla.redhat.com/): 1094265 - CVE-2014-0181 kernel: net: insufficient permision checks of netlink messages 1094602 - CVE-2014-0206 kernel: aio: insufficient sanitization of head in aio_read_events_ring() 1096775 - CVE-2014-3144 CVE-2014-3145 Kernel: filter: prevent nla extensions to peek beyond the end of the message 1102571 - CVE-2014-3917 kernel: DoS with syscall auditing 1103626 - CVE-2014-3153 kernel: futex: pi futexes requeue issue 1104097 - CVE-2014-3940 Kernel: missing check during hugepage migration 1108744 - CVE-2014-4027 Kernel: target/rd: imformation leakage 1113967 - CVE-2014-4667 kernel: sctp: sk_ack_backlog wrap-around problem 1115927 - CVE-2014-4699 kernel: x86_64: ptrace: sysret to non-canonical address 6. ============================================================================ Ubuntu Security Notice USN-2337-1 September 02, 2014 linux vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS Summary: Several security issues were fixed in the kernel. A guest OS user could exploit this flaw to cause a denial of service (host OS crash). (CVE-2014-0155) Andy Lutomirski discovered a flaw in the authorization of netlink socket operations when a socket is passed to a process of more privilege. (CVE-2014-0181) An information leak was discovered in the Linux kernels aio_read_events_ring function. (CVE-2014-4027) Sasha Levin reported an issue with the Linux kernel's shared memory subsystem when used with range notifications and hole punching. (CVE-2014-4171) Toralf F=C3=B6rster reported an error in the Linux kernels syscall auditing on 32 bit x86 platforms. (CVE-2014-4667) Vasily Averin discover a reference count flaw during attempts to umount in conjunction with a symlink. (CVE-2014-5045) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: linux-image-3.13.0-35-generic 3.13.0-35.62 linux-image-3.13.0-35-generic-lpae 3.13.0-35.62 linux-image-3.13.0-35-lowlatency 3.13.0-35.62 linux-image-3.13.0-35-powerpc-e500 3.13.0-35.62 linux-image-3.13.0-35-powerpc-e500mc 3.13.0-35.62 linux-image-3.13.0-35-powerpc-smp 3.13.0-35.62 linux-image-3.13.0-35-powerpc64-emb 3.13.0-35.62 linux-image-3.13.0-35-powerpc64-smp 3.13.0-35.62 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-server, linux-powerpc), a standard system upgrade will automatically perform this as well

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

specific network environment

TYPE

permissions and access control

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Ubuntu

SOURCES

LAST UPDATE DATE

2024-09-17T20:54:58.898000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE