Lucene search

K
osvGoogleOSV:DSA-3503-1
HistoryMar 03, 2016 - 12:00 a.m.

linux - security update

2016-03-0300:00:00
Google
osv.dev
134

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.054 Low

EPSS

Percentile

93.2%

Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service, information
leak or data loss.

  • CVE-2013-4312,
    CVE-2016-2847
    Tetsuo Handa discovered that users can use pipes queued on local
    (Unix) sockets to allocate an unfair share of kernel memory, leading
    to denial-of-service (resource exhaustion).

This issue was previously mitigated for the stable suite by limiting
the total number of files queued by each user on local sockets. The
new kernel version in both suites includes that mitigation plus
limits on the total size of pipe buffers allocated for each user.

  • CVE-2015-7566
    Ralf Spenneberg of OpenSource Security reported that the visor
    driver crashes when a specially crafted USB device without bulk-out
    endpoint is detected.
  • CVE-2015-8767
    An SCTP denial-of-service was discovered which can be triggered by a
    local attacker during a heartbeat timeout event after the 4-way
    handshake.
  • CVE-2015-8785
    It was discovered that local users permitted to write to a file on a
    FUSE filesystem could cause a denial of service (unkillable loop in
    the kernel).
  • CVE-2015-8812
    A flaw was found in the iw_cxgb3 Infiniband driver. Whenever it
    could not send a packet because the network was congested, it would
    free the packet buffer but later attempt to send the packet again.
    This use-after-free could result in a denial of service (crash or
    hang), data loss or privilege escalation.
  • CVE-2015-8816
    A use-after-free vulnerability was discovered in the USB hub driver.
    This may be used by a physically present user for privilege
    escalation.
  • CVE-2015-8830
    Ben Hawkes of Google Project Zero reported that the AIO interface
    permitted reading or writing 2 GiB of data or more in a single
    chunk, which could lead to an integer overflow when applied to
    certain filesystems, socket or device types. The full security
    impact has not been evaluated.
  • CVE-2016-0723
    A use-after-free vulnerability was discovered in the TIOCGETD ioctl.
    A local attacker could use this flaw for denial-of-service.
  • CVE-2016-0774
    It was found that the fix for CVE-2015-1805 in kernel versions older
    than Linux 3.16 did not correctly handle the case of a partially
    failed atomic read. A local, unprivileged user could use this flaw
    to crash the system or leak kernel memory to user space.
  • CVE-2016-2069
    Andy Lutomirski discovered a race condition in flushing of the TLB
    when switching tasks on an x86 system. On an SMP system this could
    possibly lead to a crash, information leak or privilege escalation.
  • CVE-2016-2384
    Andrey Konovalov found that a crafted USB MIDI device with an
    invalid USB descriptor could trigger a double-free. This may be used
    by a physically present user for privilege escalation.
  • CVE-2016-2543
    Dmitry Vyukov found that the core sound sequencer driver (snd-seq)
    lacked a necessary check for a null pointer, allowing a user
    with access to a sound sequencer device to cause a denial-of service (crash).
  • CVE-2016-2544,
    CVE-2016-2546,
    CVE-2016-2547,
    CVE-2016-2548
    Dmitry Vyukov found various race conditions in the sound subsystem
    (ALSA)'s management of timers. A user with access to sound devices
    could use these to cause a denial-of-service (crash or hang) or
    possibly for privilege escalation.
  • CVE-2016-2545
    Dmitry Vyukov found a flaw in list manipulation in the sound
    subsystem (ALSA)'s management of timers. A user with access to sound
    devices could use this to cause a denial-of-service (crash or hang)
    or possibly for privilege escalation.
  • CVE-2016-2549
    Dmitry Vyukov found a potential deadlock in the sound subsystem
    (ALSA)'s use of high resolution timers. A user with access to sound
    devices could use this to cause a denial-of-service (hang).
  • CVE-2016-2550
    The original mitigation of
    CVE-2013-4312,
    limiting the total number
    of files a user could queue on local sockets, was flawed. A user
    given a local socket opened by another user, for example through the
    systemd socket activation mechanism, could make use of the other
    user’s quota, again leading to a denial-of-service (resource
    exhaustion). This is fixed by accounting queued files to the sender
    rather than the socket opener.

For the oldstable distribution (wheezy), these problems have been fixed
in version 3.2.73-2+deb7u3. The oldstable distribution (wheezy) is not
affected by CVE-2015-8830.

For the stable distribution (jessie), these problems have been fixed in
version 3.16.7-ckt20-1+deb8u4. CVE-2013-4312, CVE-2015-7566, CVE-2015-8767 and
CVE-2016-0723 were already fixed in DSA-3448-1. CVE-2016-0774 does not
affect the stable distribution.

We recommend that you upgrade your linux packages.

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.054 Low

EPSS

Percentile

93.2%