ESB-2018.0106 - [Debian] kernel: Multiple vulnerabilities 2018-01-10

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.0106
                       Debian linux security update
                              10 January 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           kernel
Publisher:         Debian
Operating System:  Debian GNU/Linux 8
Impact/Access:     Root Compromise          -- Existing Account
                   Access Privileged Data   -- Existing Account
                   Denial of Service        -- Existing Account
                   Access Confidential Data -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2017-1000410 CVE-2017-1000407 CVE-2017-17807
                   CVE-2017-17806 CVE-2017-17805 CVE-2017-17741
                   CVE-2017-17558 CVE-2017-17450 CVE-2017-17449
                   CVE-2017-17448 CVE-2017-16939 CVE-2017-16538
                   CVE-2017-15868 CVE-2017-8824 CVE-2017-5754

Reference:         ASB-2018.0002.4
                   ESB-2018.0102
                   ESB-2018.0096
                   ESB-2018.0044
                   ESB-2018.0012
                   ESB-2017.3259

Original Bulletin: 
   http://www.debian.org/security/2018/dsa-4082

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4082-1                   security@debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
January 09, 2018                      https://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : linux
CVE ID         : CVE-2017-5754 CVE-2017-8824 CVE-2017-15868 CVE-2017-16538
                 CVE-2017-16939 CVE-2017-17448 CVE-2017-17449 CVE-2017-17450
                 CVE-2017-17558 CVE-2017-17741 CVE-2017-17805 CVE-2017-17806
                 CVE-2017-17807 CVE-2017-1000407 CVE-2017-1000410

Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.

CVE-2017-5754

    Multiple researchers have discovered a vulnerability in Intel
    processors, enabling an attacker controlling an unprivileged
    process to read memory from arbitrary addresses, including from
    the kernel and all other processes running on the system.

    This specific attack has been named Meltdown and is addressed in
    the Linux kernel for the Intel x86-64 architecture by a patch set
    named Kernel Page Table Isolation, enforcing a near complete
    separation of the kernel and userspace address maps and preventing
    the attack. This solution might have a performance impact, and can
    be disabled at boot time by passing `pti=off' to the kernel
    command line.

CVE-2017-8824

    Mohamed Ghannam discovered that the DCCP implementation did not
    correctly manage resources when a socket is disconnected and
    reconnected, potentially leading to a use-after-free.  A local
    user could use this for denial of service (crash or data
    corruption) or possibly for privilege escalation.  On systems that
    do not already have the dccp module loaded, this can be mitigated
    by disabling it:
    echo >> /etc/modprobe.d/disable-dccp.conf install dccp false

CVE-2017-15868

    Al Viro found that the Bluebooth Network Encapsulation Protocol
    (BNEP) implementation did not validate the type of the second
    socket passed to the BNEPCONNADD ioctl(), which could lead to
    memory corruption.  A local user with the CAP_NET_ADMIN capability
    can use this for denial of service (crash or data corruption) or
    possibly for privilege escalation.

CVE-2017-16538

    Andrey Konovalov reported that the dvb-usb-lmedm04 media driver
    did not correctly handle some error conditions during
    initialisation.  A physically present user with a specially
    designed USB device can use this to cause a denial of service
    (crash).

CVE-2017-16939

    Mohamed Ghannam reported (through Beyond Security's SecuriTeam
    Secure Disclosure program) that the IPsec (xfrm) implementation
    did not correctly handle some failure cases when dumping policy
    information through netlink.  A local user with the CAP_NET_ADMIN
    capability can use this for denial of service (crash or data
    corruption) or possibly for privilege escalation.

CVE-2017-17448

    Kevin Cernekee discovered that the netfilter subsystem allowed
    users with the CAP_NET_ADMIN capability in any user namespace, not
    just the root namespace, to enable and disable connection tracking
    helpers.  This could lead to denial of service, violation of
    network security policy, or have other impact.

CVE-2017-17449

    Kevin Cernekee discovered that the netlink subsystem allowed
    users with the CAP_NET_ADMIN capability in any user namespace
    to monitor netlink traffic in all net namespaces, not just
    those owned by that user namespace.  This could lead to
    exposure of sensitive information.

CVE-2017-17450

    Kevin Cernekee discovered that the xt_osf module allowed users
    with the CAP_NET_ADMIN capability in any user namespace to modify
    the global OS fingerprint list.

CVE-2017-17558

    Andrey Konovalov reported that that USB core did not correctly
    handle some error conditions during initialisation.  A physically
    present user with a specially designed USB device can use this to
    cause a denial of service (crash or memory corruption), or
    possibly for privilege escalation.

CVE-2017-17741

    Dmitry Vyukov reported that the KVM implementation for x86 would
    over-read data from memory when emulating an MMIO write if the
    kvm_mmio tracepoint was enabled.  A guest virtual machine might be
    able to use this to cause a denial of service (crash).

CVE-2017-17805

    Dmitry Vyukov reported that the KVM implementation for x86 would
    over-read data from memory when emulating an MMIO write if the
    kvm_mmio tracepoint was enabled.  A guest virtual machine might be
    able to use this to cause a denial of service (crash).

CVE-2017-17806

    It was discovered that the HMAC implementation could be used with
    an underlying hash algorithm that requires a key, which was not
    intended.  A local user could use this to cause a denial of
    service (crash or memory corruption), or possibly for privilege
    escalation.

CVE-2017-17807

    Eric Biggers discovered that the KEYS subsystem lacked a check for
    write permission when adding keys to a process's default keyring.
    A local user could use this to cause a denial of service or to
    obtain sensitive information.

CVE-2017-1000407

    Andrew Honig reported that the KVM implementation for Intel
    processors allowed direct access to host I/O port 0x80, which
    is not generally safe.  On some systems this allows a guest
    VM to cause a denial of service (crash) of the host.

CVE-2017-1000410

    Ben Seri reported that the Bluetooth subsystem did not correctly
    handle short EFS information elements in L2CAP messages.  An
    attacker able to communicate over Bluetooth could use this to
    obtain sensitive information from the kernel.

For the oldstable distribution (jessie), these problems have been fixed
in version 3.16.51-3+deb8u1.

We recommend that you upgrade your linux packages.

For the detailed security status of linux please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/linux

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlpU5cRfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0Qsnw//euNWKwOR4R+JFEyKECrS5GHFzLdj1kpion3oGGZyyJ8VjmVv+MombQPk
xk17ge5QWl44CMzXlkE6QREdrXQfed49us9O6CzS2BPwV/QWsoUc7WLmqYD0OQmh
c5/RqvkzUfXzEJ7efLzChXAs94RB0A9kOKoRxNrXfdhvevM+FumB17dErIrT2nxP
KcX3Tyh05twrJqCnbNIo189LDexKfEyAN9pnwBekknzXB0V3zmvPwebVz85v1I8p
aiWSXX9EjWvVeZG31XDOysEcrwO4T71zqCgPxPeurAOVTJNvK0B8je7wFBD9ayoy
PFNdykxRUBA9rBJ8Aoi3zcZBJYxTYBzOKDUkPaO/80mflsN6yDCaWwQ+antyuQ8y
jO02bAEZiKmpsuclKvK48rfvtoFqXsp6WhO1NoWnmpFvsxXN0DdqKRB60rycrMMA
Q2wLYnPX2QNRNdxtkJ0D380VkTdPjJT4yOPM4UuIJ1S7jwzVcQKnu8VswdFey0nq
k42DigyVQryZd1elqiyGWWtNkJ9BRscSgkpCAfEUo2XCR61wEXu7aOHGksPuTTZr
2FJGIa4OR1dAc2pPGy7CUWYnloGwSCCq7F85bi6v5KG7YnHlic/XnJva+hT+0lGT
1HQlCKU9bicaLL0GIK9Qt5vaUseZLWiOXMHU6JKvo/y6AL3FHnI=
=Ozoc
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWlV4Fox+lLeg9Ub1AQhf+g//QxgPel8DYV+adkICJEcy4+g2+g60tVMN
JmwksUmH3Yh0pJ+98miYid6NeoDQ7Q29Mh9NqLRWEiBiJa/6rDdcgLBrz7Ro873Z
8CsVX2KGAC9fVzRKS3Hj+YCreCjlIk5fa/9xUW3+WB3gjbPPFfp9sDzfTN/LToDO
/1DodRX97yRXQ4Seo0ojrSqbnLmophlMRjlljJdIZyF3P/WXneShjyxuVZV7VA16
4Jmj2q4fg7QeJdtGSC0hZaehOOIJQybGbzXfBT6VUNnA31T6c3IV0puENBrXNPws
2COHVgpJKmwsd8QaMINs97N6fX3rjK0wJN/dfWmMIRdPbRFsPK0dkFkFO7+NUkNU
RWVT7nfW7Kuz1XJeHiMRa6V9OrsnHxdkGNI6hsqYkT4IzWWNeHNPc+gj36I14T/0
VjRlONR1Zz4vPiOrXRPFw8I3S3ko1cMQC8yDlz19Kv0H+zhglJ9oBOsGJI8GczPj
bOoDzmrOgk9pt5J5Wgo9ZfP32+yIYJQxajD5SW2k9WGxyeczChwahn8l9/i4iMsz
kPLDc4+FMs1amHchrdsHw0B8MFhowQ8zB8+CzqLyDYyyHoqYfb2ENBnZYuQA5tr9
ooM0R6kM+PU3X3llV9PPxz7tPY5FYLTrpFo/VYrCnz1asuWI2VE6aRyoB9kv7hbE
3nX8bARCorQ=
=guej
-----END PGP SIGNATURE-----

« Back to bulletins