Security Bulletin: Vulnerabilities in the Linux kernel affect PowerKVM

Summary

PowerKVM is affected by vulnerabilities in the Linux kernel . IBM has now addressed these vulnerabilities.

Vulnerability Details

CVEID: CVE-2017-9242**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by an error in the __ip6_append_data function when checking whether an overwrite of an skb data structure may occur. An attacker could exploit this vulnerability using specially crafted system calls to cause the system to crash.
CVSS Base Score: 5.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/127805&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2017-9077**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by an error in the tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c. By using a specially-crafted system calls, a local attacker could exploit this vulnerability to cause a denial of service condition or other unspecified impact.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/126256&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2017-9076**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by an error in the dccp_v6_request_recv_sock function in net/dccp/ipv6.c. By using specially-crafted system calls, a local attacker could exploit this vulnerability to cause a denial of service condition or other unspecified impact.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/126255&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2017-7616**
DESCRIPTION:** Linux Kernel could allow a local attacker to obtain sensitive information, caused by incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c. By triggering failure of a certain bitmap operation, an attacker could exploit this vulnerability to obtain sensitive information from uninitialized stack data.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/124563&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID: CVE-2017-7187**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by a stack-based buffer overflow in sg_ioctl function in drivers/scsi/sg.c. By using a large command size in an SG_NEXT_CMD_LEN ioctl call, a local attacker could exploit this vulnerability to cause the system to crash or other unspecified impact.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/123509&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2017-6951**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference in the keyring_search_aux function in security/keys/keyring.c. By using a request_key system call for the “dead” type, a local attacker could exploit this vulnerability to cause the system to crash.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/123423&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2017-6001**
DESCRIPTION:** Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a race condition in the kernel/events/core.c. By using a specially-crafted application, an attacker could exploit this vulnerability to gain privileges on the system.
CVSS Base Score: 7
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/122171&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

CVEID: CVE-2017-5970**
DESCRIPTION:** Linux kernel is vulnerable to a denial of service, caused by an error in the ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c. By using a specially-crafted application that makes malformed system calls or IPv4 traffic with invalid IP options, a remote attacker could exploit this vulnerability to cause system to crash.
CVSS Base Score: 7.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/122003&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2017-2671**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by an error in the ping_unhash function. By leveraging access to the protocol value of IPPROTO_ICMP in a socket system call, a local attacker could exploit this vulnerability to cause the system to panic.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/127408&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2017-2596**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by the improper emulation of the VMXON instruction by the nested_vmx_check_vmptr function. By leveraging the mishandling of page references, an attacker could exploit this vulnerability to cause host OS memory consumption and the system to crash.
CVSS Base Score: 5.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/122080&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2016-9806**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by a race condition in the netlink_dump function in net/netlink/af_netlink.c. By using a specially-crafted application, a local attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 7.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/120228&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

CVEID: CVE-2016-9685**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by a memory leak in the fs/xfs/xfs_attr_list.c. By using a specially-crafted XFS filesystem operations, a local attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 5.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/120243&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2016-9604**
DESCRIPTION:** Linux Kernel could allow a local attacker to bypass security restrictions, caused by an error in the built-in keyrings for security tokens. By adding a new public key of its own devising to the keyring, an attacker could exploit this vulnerability to bypass module signature verification and gain direct access to an internal keyring.
CVSS Base Score: 4.4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/125570&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)

CVEID: CVE-2017-9075**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by an error in the sctp_v6_create_accept_sk function in net/sctp/ipv6.c. By using specially-crafted system calls, a local attacker could exploit this vulnerability to cause a denial of service condition or other unspecified impact.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/126254&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2017-9074**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by the failure to consider that the nexthdr field may be associated with an invalid option by the IPv6 fragmentation implementation. By using a specially-crafted socket and send system calls, a local attacker could exploit this vulnerability to cause a denial of service condition or other unspecified impact.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/126253&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2017-8890**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by a double free in inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c. By leveraging use of the accept system call, an attacker could exploit this vulnerability to cause the system to crash.
CVSS Base Score: 4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/125914&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2017-8797**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by an error in the NFSv4 Server. By sending a specially crafted NFSv4 pNFS LAYOUTGET command using UDP, a remote attacker on a system within the target mount’'s host address mask range could exploit this vulnerability to cause the service to crash.
CVSS Base Score: 5.9
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/127765&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2016-10200**
DESCRIPTION:** Linux Kernel could allow a local attacker to gain elevated privileges on the system, caused by a race condition in the l2tp_ip6_bind() function in the L2TPv3 IP Encapsulation feature. By making multiple bind system calls, an attacker could exploit this vulnerability to trigger a use-after-free and gain elevated privileges on the system.
CVSS Base Score: 7.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/122901&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

CVEID: CVE-2016-10147**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference in crypto/mcryptd.c. By using an AF_ALG socket with an incompatible algorithm, a local authenticated attacker could exploit this vulnerability to cause the system to crash.
CVSS Base Score: 5.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/124085&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2016-10088**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by an use-after-free error in the sg implementation. By leveraging access to a /dev/sg device, a local attacker could exploit this vulnerability to cause a denial of service.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/120237&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2016-10088**
DESCRIPTION:** Linux Kernel could allow a local attacker to gain elevated privileges on the system, caused by the failure to properly restrict write operations in situations where the KERNEL_DS option is set by the sg_write() and bsg_write() Functions in block/bsg.c and drivers/scsi/sg.c. By leveraging access to a /dev/sg device, an attacker could exploit this vulnerability to write arbitrary kernel memory and gain root privileges on the system.
CVSS Base Score: 8.4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/120225&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID: CVE-2015-8970**
DESCRIPTION:** Linux Kernel is vulnerable to a NULL pointer dereference in big_key.c, caused by the improper handling of setkey operation. A local attacker could exploit this vulnerability using a specially crafted application to cause the kernel to crash.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/120131&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2015-8839**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by multiple race conditions in the ext4 filesystem implementation. By writing to a page, an attacker could exploit this vulnerability to corrupt the disk.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/114520&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2014-7975**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by an error in do_umount function in fs/namespace.c. A local attacker could exploit this vulnerability using a umount call to cause the file system to become inaccessible.
CVSS Base Score: 4.9
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/96994&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C)

CVEID: CVE-2014-7970**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by an error in the VFS filesystem pivot_root() function. A local attacker could exploit this vulnerability to cause the system to crash.
CVSS Base Score: 4.9
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/96921&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C)

CVEID: CVE-2016-9588**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by mishandling the exceptions in the arch/x86/kvm/vmx.c. By declining to handle an exception thrown by a L2 guest, a local attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 5.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/120244&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2016-9576**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by a use-after-free error in the blk_rq_map_user_iov function in block/blk-map.c. By accessing /dev/sg* scsi generic devices, a local attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 7.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/120245&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

CVEID: CVE-2016-8645**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by the failure to properly maintain certain BUG state in tcp_collapse() function in net/ipv4/tcp_input.c. By executing specially-crafted system calls, an attacker could exploit this vulnerability to cause a denial of service.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/118962&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2016-7097**
DESCRIPTION:** Linux Kernel could allow a local attacker to gain elevated privileges on the system, caused by the setgid bit being preserved during a setxattr call by the filesystem implementation. By leveraging the existence of a setgid program, an attacker could exploit this vulnerability to gain group privileges.
CVSS Base Score: 8.4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/118151&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID: CVE-2016-7042**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by the use of an incorrect buffer size for certain timeout data by the proc_keys_show function in security/keys/proc.c. By reading the /proc/keys file, an attacker could exploit this vulnerability to cause the kernel to panic.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/118133&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2016-6213**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by an error in the mount table. By overflowing kernel mount table using shared bind mount, a local attacker could exploit this vulnerability to cause a denial of service.
CVSS Base Score: 4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/114989&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2017-16532**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by NULL pointer dereference in the get_endpoints function in drivers/usb/misc/usbtest.c. By using a specially crafted USB device, a local attacker could exploit this vulnerability to cause the system crash.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/134452&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2017-15115**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by a use-after-free in the sctp_do_peeloff function in net/sctp/socket.c. By using specially-crafted system calls, a local attacker could exploit this vulnerability to cause the system to crash.
CVSS Base Score: 4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/135068&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2017-17741**
DESCRIPTION:** Linux kernel is vulnerable to a denial of service, caused by stack-based out-of-bounds read in the KVM implementation. A local attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/136494&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2017-16650**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by a divide-by-zero in the qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c. By using a specially-crafted USB device, a local attacker could exploit this vulnerability to cause the system to crash.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/134645&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2017-16649**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by a divide-by-zero in the usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c. By using a specially-crafted USB device, a local attacker could exploit this vulnerability to cause the system to crash.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/134644&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2017-16537**
DESCRIPTION:** Linux Kernel is vulnerable to a denial of service, caused by NULL pointer dereference in the imon_probe function in drivers/media/rc/imon.c. By using a specially crafted USB device, a local attacker could exploit this vulnerability to cause the system crash.
CVSS Base Score: 6.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/134444&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

PowerKVM v3.1

Remediation/Fixes

Customers can update PowerKVM systems by using “yum update”.

Fix images are made available via Fix Central. See https://ibm.biz/BdHggw. This issue is addressed starting with v3.1.0.2 update 12.

Workarounds and Mitigations

none