ESB-2017.1958 - linux kernel: Multiple vulnerabilities 2017-08-08

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2017.1958
                           linux security update
                               8 August 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           linux kernel
Publisher:         Debian
Impact/Access:     Root Compromise          -- Existing Account
                   Denial of Service        -- Existing Account
                   Access Confidential Data -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2017-1000365 CVE-2017-11176 CVE-2017-10911
                   CVE-2017-10810 CVE-2017-9605 CVE-2017-7542
                   CVE-2017-7541 CVE-2017-7533 CVE-2017-7482
                   CVE-2017-7346  

Reference:         ESB-2017.1929
                   ESB-2017.1808
                   ESB-2017.1798
                   ESB-2017.1749

Original Bulletin: 
   http://www.debian.org/security/2017/dsa-3927

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3927-1                   security@debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
August 07, 2017                       https://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : linux
CVE ID         : CVE-2017-7346 CVE-2017-7482 CVE-2017-7533 CVE-2017-7541
                 CVE-2017-7542 CVE-2017-9605 CVE-2017-10810 CVE-2017-10911
                 CVE-2017-11176 CVE-2017-1000365

Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.

CVE-2017-7346

    Li Qiang discovered that the DRM driver for VMware virtual GPUs does
    not properly check user-controlled values in the
    vmw_surface_define_ioctl() functions for upper limits. A local user
    can take advantage of this flaw to cause a denial of service.

CVE-2017-7482

    Shi Lei discovered that RxRPC Kerberos 5 ticket handling code does
    not properly verify metadata, leading to information disclosure,
    denial of service or potentially execution of arbitrary code.

CVE-2017-7533

    Fan Wu and Shixiong Zhao discovered a race condition between inotify
    events and VFS rename operations allowing an unprivileged local
    attacker to cause a denial of service or escalate privileges.

CVE-2017-7541

    A buffer overflow flaw in the Broadcom IEEE802.11n PCIe SoftMAC WLAN
    driver could allow a local user to cause kernel memory corruption,
    leading to a denial of service or potentially privilege escalation.

CVE-2017-7542

    An integer overflow vulnerability in the ip6_find_1stfragopt()
    function was found allowing a local attacker with privileges to open
    raw sockets to cause a denial of service.

CVE-2017-9605

    Murray McAllister discovered that the DRM driver for VMware virtual
    GPUs does not properly initialize memory, potentially allowing a
    local attacker to obtain sensitive information from uninitialized
    kernel memory via a crafted ioctl call.

CVE-2017-10810

    Li Qiang discovered a memory leak flaw within the VirtIO GPU driver
    resulting in denial of service (memory consumption).

CVE-2017-10911 / XSA-216

    Anthony Perard of Citrix discovered an information leak flaw in Xen
    blkif response handling, allowing a malicious unprivileged guest to
    obtain sensitive information from the host or other guests.

CVE-2017-11176

    It was discovered that the mq_notify() function does not set the
    sock pointer to NULL upon entry into the retry logic. An attacker
    can take advantage of this flaw during a user-space close of a
    Netlink socket to cause a denial of service or potentially cause
    other impact.

CVE-2017-1000365

    It was discovered that argument and environment pointers are not
    taken properly into account to the imposed size restrictions on
    arguments and environmental strings passed through
    RLIMIT_STACK/RLIMIT_INFINITY. A local attacker can take advantage of
    this flaw in conjunction with other flaws to execute arbitrary code.

For the oldstable distribution (jessie), these problems will be fixed in
a subsequent DSA.

For the stable distribution (stretch), these problems have been fixed in
version 4.9.30-2+deb9u3.

We recommend that you upgrade your linux packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlmH92RfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0Q3wg//Trx3JpxUkvUY1x33AnhJqGg/9GShz6U1MGnBjKkNwpUH8FICXDHbzYzP
n7GULdxgvtVQypfJni9+Gsvk6EcILcNUTUb9e9gknfLFumHl5KUhAJIOh9Fdb/u2
VYvGwFT5OaO/JqXARhxa3a+SHCSybslUSuyp3hxvjTT0jcl8wBTgkeQYKdlqJp8v
ArklOQoAHVXs+Xq1PFSFDdoN9aOryIXcqGytnx/y1KqH3U4FpQn8AcIIAB53YN5X
NF+GmOewvgZn/7xkVGrqbvh8bhst/Yv5A3CTl1EvY8biApuWYGIKpQiThUtgQs8U
eD/0xoP3rN+NxWoMWyACZqrKH5VaSkcwkkBTGa4BlklHaElFHhlIFXdnP4lMdCZ4
tSBd8UGPFwtF3cyq/nH+9tVmnAqH95sclLf8yvkxxv+vtbZsixJJRlnRdf/nszuT
OOVFsRp/7l7MuqiLErHJkPKHoQ7rZ847GF5flCev6rz7OLQKA2IKPj4RdQKcQ+Ze
Vv6/ZtTcKspD7EoQJyrTC8MBJYvY0g7kswzQDUxKqJA2hIkVY3FEhh94ONZAUady
x6+Nb/a/oAlcZ0wjev1p8ayxtfAAaiuuqxoGbd7rdZkyB1C0eb13XdiOI7yDkdVp
4G8iVjOUdYdKRXlxW9FX+rZhS+yEX8ZbWNZGqThEc/oX0uj6XVo=
=82mY
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWYlRGIx+lLeg9Ub1AQipig/+PUpXb4e2eCgEBOEsUWdcdtMLFiAIiYoA
EZywiL93Ws7PTReu3cZRUzzCYziawdzguuyYLAIN+MqCoDYddUPHbPYowcVnYFNW
miM1q9Uf28m1Fk8D9V4YpXXyoJnhfTazsN/z/SnIg+UH8s6AQcgIuUwQaYCywSQC
kA+yhlk0pbFNdqrhp0MZIsNQZFKCX/GKg/cVgy8wLymAVYyzgDq6pCEIHoBS3Ez7
nxNkpMZWqTogC+42sqDpXeOawiWA8zec8bTHLg8KlLXpHGISBPD7jOWkziemysV3
OCCTQD5Qer5bz8GjzYVECw+Am5LU8AJb6FCUr2I68+R7uMZL6FsUe6dhpkM+wYh9
wFGzua0+vqn2IAoBztF0h4TLG1uH2+a9ljPzP0BuRm+9IlolOEId5ECRTdcvNjnZ
cwlZrsg7cLO0PpsnAztXsh7Ay6XVhUQ/3VH4UJeD2/A8CUnKPgz3Q/1QdzzHF4fk
QTdbHzWvzxmtb5hqHFfaQS4qSGgzGVHG/oeqifLqUx8q5Q8xmPAKQapMNUPmQzHG
uQJZt5tXi3TiqCjmA+yw/yparyT7XxwLPbo7Cvfoxy20V7yaWf7Ozv+42PpDpv7H
pzbpZjAOFJkgTwKoYrLn47xvlAjjTdnqHZyin/14+2O4bO/PCUkwvrVgryuIUGDQ
uHzCsMbC65Y=
=37P1
-----END PGP SIGNATURE-----

« Back to bulletins