linux - security update


Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. * [CVE-2017-0605](https://security-tracker.debian.org/tracker/CVE-2017-0605) A buffer overflow flaw was discovered in the trace subsystem. * [CVE-2017-7487](https://security-tracker.debian.org/tracker/CVE-2017-7487) Li Qiang reported a reference counter leak in the ipxitf\_ioctl function which may result into a use-after-free vulnerability, triggerable when a IPX interface is configured. * [CVE-2017-7645](https://security-tracker.debian.org/tracker/CVE-2017-7645) Tuomas Haanpaa and Matti Kamunen from Synopsys Ltd discovered that the NFSv2 and NFSv3 server implementations are vulnerable to an out-of-bounds memory access issue while processing arbitrarily long arguments sent by NFSv2/NFSv3 PRC clients, leading to a denial of service. * [CVE-2017-7895](https://security-tracker.debian.org/tracker/CVE-2017-7895) Ari Kauppi from Synopsys Ltd discovered that the NFSv2 and NFSv3 server implementations do not properly handle payload bounds checking of WRITE requests. A remote attacker with write access to a NFS mount can take advantage of this flaw to read chunks of arbitrary memory from both kernel-space and user-space. * [CVE-2017-8890](https://security-tracker.debian.org/tracker/CVE-2017-8890) It was discovered that the net\_csk\_clone\_lock() function allows a remote attacker to cause a double free leading to a denial of service or potentially have other impact. * [CVE-2017-8924](https://security-tracker.debian.org/tracker/CVE-2017-8924) Johan Hovold found that the io\_ti USB serial driver could leak sensitive information if a malicious USB device was connected. * [CVE-2017-8925](https://security-tracker.debian.org/tracker/CVE-2017-8925) Johan Hovold found a reference counter leak in the omninet USB serial driver, resulting in a use-after-free vulnerability. This can be triggered by a local user permitted to open tty devices. * [CVE-2017-9074](https://security-tracker.debian.org/tracker/CVE-2017-9074) Andrey Konovalov reported that the IPv6 fragmentation implementation could read beyond the end of a packet buffer. A local user or guest VM might be able to use this to leak sensitive information or to cause a denial of service (crash). * [CVE-2017-9075](https://security-tracker.debian.org/tracker/CVE-2017-9075) Andrey Konovalov reported that the SCTP/IPv6 implementation wrongly initialised address lists on connected sockets, resulting in a use-after-free vulnerability, a similar issue to [CVE-2017-8890](https://security-tracker.debian.org/tracker/CVE-2017-8890). This can be triggered by any local user. * [CVE-2017-9076](https://security-tracker.debian.org/tracker/CVE-2017-9076) / [CVE-2017-9077](https://security-tracker.debian.org/tracker/CVE-2017-9077) Cong Wang found that the TCP/IPv6 and DCCP/IPv6 implementations wrongly initialised address lists on connected sockets, a similar issue to [CVE-2017-9075](https://security-tracker.debian.org/tracker/CVE-2017-9075). * [CVE-2017-9242](https://security-tracker.debian.org/tracker/CVE-2017-9242) Andrey Konovalov reported a packet buffer overrun in the IPv6 implementation. A local user could use this for denial of service (memory corruption; crash) and possibly for privilege escalation. * [CVE-2017-1000364](https://security-tracker.debian.org/tracker/CVE-2017-1000364) The Qualys Research Labs discovered that the size of the stack guard page is not sufficiently large. The stack-pointer can jump over the guard-page and moving from the stack into another memory region without accessing the guard-page. In this case no page-fault exception is raised and the stack extends into the other memory region. An attacker can exploit this flaw for privilege escalation. The default stack gap protection is set to 256 pages and can be configured via the stack\_guard\_gap kernel parameter on the kernel command line. Further details can be found at <https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt> For Debian 7 Wheezy, these problems have been fixed in version 3.2.89-1. This version also includes bug fixes from upstream version 3.2.89. For Debian 8 Jessie, these problems have been fixed in version 3.16.43-2+deb8u1. For Debian 9 Stretch, these problems have been fixed in version 4.9.30-2+deb9u1 or earlier versions before the stretch release. We recommend that you upgrade your linux packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: <https://wiki.debian.org/LTS>

Affected Software

CPE Name Name Version
linux 3.2.41-2
linux 3.2.41-2+deb7u1
linux 3.2.41-2+deb7u2
linux 3.2.41-2+deb7u2~bpo60+1
linux 3.2.46-1
linux 3.2.46-1+deb7u1
linux 3.2.46-1+deb7u1~bpo60+1
linux 3.2.46-1~bpo60+1
linux 3.2.51-1
linux 3.2.51-1~bpo60+1
linux 3.2.53-1
linux 3.2.53-2
linux 3.2.54-1
linux 3.2.54-2
linux 3.2.54-2~bpo60+1
linux 3.2.57-1
linux 3.2.57-2
linux 3.2.57-3
linux 3.2.57-3+deb7u1
linux 3.2.57-3+deb7u2
linux 3.2.57-3+deb7u2~bpo60+1
linux 3.2.60-1
linux 3.2.60-1+deb7u1
linux 3.2.60-1+deb7u2
linux 3.2.60-1+deb7u3
linux 3.2.60-1+deb7u3~bpo60+1
linux 3.2.63-1
linux 3.2.63-2
linux 3.2.63-2+deb7u1
linux 3.2.63-2+deb7u1~bpo60+1
linux 3.2.63-2+deb7u2
linux 3.2.63-2+deb7u2~bpo60+1
linux 3.2.65-1
linux 3.2.65-1+deb7u1
linux 3.2.65-1+deb7u1~bpo60+1
linux 3.2.65-1+deb7u2
linux 3.2.65-1+deb7u2~bpo60+1
linux 3.2.68-1
linux 3.2.68-1+deb7u1
linux 3.2.68-1+deb7u1~bpo60+1
linux 3.2.68-1+deb7u2
linux 3.2.68-1+deb7u2~bpo60+1
linux 3.2.68-1+deb7u3
linux 3.2.68-1+deb7u3~bpo60+1
linux 3.2.68-1+deb7u4
linux 3.2.68-1+deb7u4~bpo60+1
linux 3.2.68-1+deb7u5
linux 3.2.68-1+deb7u6
linux 3.2.68-1+deb7u6~bpo60+1
linux 3.2.71-1
linux 3.2.71-2
linux 3.2.73-1
linux 3.2.73-2
linux 3.2.73-2+deb7u1
linux 3.2.73-2+deb7u2
linux 3.2.73-2+deb7u2~bpo60+1
linux 3.2.73-2+deb7u3
linux 3.2.78-1
linux 3.2.81-1
linux 3.2.81-2
linux 3.2.82-1
linux 3.2.84-1
linux 3.2.84-2
linux 3.2.86-1
linux 3.2.88-1