Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2015.1137 linux security update 27 April 2015 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: linux Publisher: Debian Operating System: Debian GNU/Linux 8 Debian GNU/Linux 7 Linux variants Impact/Access: Root Compromise -- Existing Account Denial of Service -- Remote/Unauthenticated Access Confidential Data -- Remote/Unauthenticated Unauthorised Access -- Console/Physical Resolution: Patch/Upgrade CVE Names: CVE-2015-3339 CVE-2015-3332 CVE-2015-3331 CVE-2015-2922 CVE-2015-2830 CVE-2015-2150 CVE-2015-2042 CVE-2015-2041 CVE-2014-9715 CVE-2014-8159 Reference: ESB-2015.1113 ESB-2015.0989 ESB-2015.0870 ESB-2015.0799 ESB-2015.0620 Original Bulletin: http://www.debian.org/security/2015/dsa-3237 Comment: This advisory references vulnerabilities in products which run on platforms other than Debian. It is recommended that administrators running linux check for an updated version of the software for their operating system. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - - ------------------------------------------------------------------------- Debian Security Advisory DSA-3237-1 security@debian.org http://www.debian.org/security/ Ben Hutchings April 26, 2015 http://www.debian.org/security/faq - - ------------------------------------------------------------------------- Package : linux CVE ID : CVE-2014-8159 CVE-2014-9715 CVE-2015-2041 CVE-2015-2042 CVE-2015-2150 CVE-2015-2830 CVE-2015-2922 CVE-2015-3331 CVE-2015-3332 CVE-2015-3339 Debian Bug : 741667 782515 782561 782698 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2014-8159 It was found that the Linux kernel's InfiniBand/RDMA subsystem did not properly sanitize input parameters while registering memory regions from user space via the (u)verbs API. A local user with access to a /dev/infiniband/uverbsX device could use this flaw to crash the system or, potentially, escalate their privileges on the system. CVE-2014-9715 It was found that the netfilter connection tracking subsystem used too small a type as an offset within each connection's data structure, following a bug fix in Linux 3.2.33 and 3.6. In some configurations, this would lead to memory corruption and crashes (even without malicious traffic). This could potentially also result in violation of the netfilter policy or remote code execution. This can be mitigated by disabling connection tracking accounting: sysctl net.netfilter.nf_conntrack_acct=0 CVE-2015-2041 Sasha Levin discovered that the LLC subsystem exposed some variables as sysctls with the wrong type. On a 64-bit kernel, this possibly allows privilege escalation from a process with CAP_NET_ADMIN capability; it also results in a trivial information leak. CVE-2015-2042 Sasha Levin discovered that the RDS subsystem exposed some variables as sysctls with the wrong type. On a 64-bit kernel, this results in a trivial information leak. CVE-2015-2150 Jan Beulich discovered that Xen guests are currently permitted to modify all of the (writable) bits in the PCI command register of devices passed through to them. This in particular allows them to disable memory and I/O decoding on the device unless the device is an SR-IOV virtual function, which can result in denial of service to the host. CVE-2015-2830 Andrew Lutomirski discovered that when a 64-bit task on an amd64 kernel makes a fork(2) or clone(2) system call using int $0x80, the 32-bit compatibility flag is set (correctly) but is not cleared on return. As a result, both seccomp and audit will misinterpret the following system call by the task(s), possibly leading to a violation of security policy. CVE-2015-2922 Modio AB discovered that the IPv6 subsystem would process a router advertisement that specifies no route but only a hop limit, which would then be applied to the interface that received it. This can result in loss of IPv6 connectivity beyond the local network. This may be mitigated by disabling processing of IPv6 router advertisements if they are not needed: sysctl net.ipv6.conf.default.accept_ra=0 sysctl net.ipv6.conf.<interface>.accept_ra=0 CVE-2015-3331 Stephan Mueller discovered that the optimised implementation of RFC4106 GCM for x86 processors that support AESNI miscalculated buffer addresses in some cases. If an IPsec tunnel is configured to use this mode (also known as AES-GCM-ESP) this can lead to memory corruption and crashes (even without malicious traffic). This could potentially also result in remote code execution. CVE-2015-3332 Ben Hutchings discovered that the TCP Fast Open feature regressed in Linux 3.16.7-ckt9, resulting in a kernel BUG when it is used. This can be used as a local denial of service. CVE-2015-3339 It was found that the execve(2) system call can race with inode attribute changes made by chown(2). Although chown(2) clears the setuid/setgid bits of a file if it changes the respective owner ID, this race condition could result in execve(2) setting effective uid/gid to the new owner ID, a privilege escalation. For the oldstable distribution (wheezy), these problems have been fixed in version 3.2.68-1+deb7u1. The linux package in wheezy is not affected by CVE-2015-3332. For the stable distribution (jessie), these problems have been fixed in version 3.16.7-ckt9-3~deb8u1 or earlier versions. Additionally, this version fixes a regression in the xen-netfront driver (#782698). For the unstable distribution (sid), these problems have been fixed in version 3.16.7-ckt9-3 or earlier versions. Additionally, this version fixes a regression in the xen-netfront driver (#782698). We recommend that you upgrade your linux packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJVPNTpAAoJEAVMuPMTQ89EF7UQAJexW3qTFY6CUo+i9Yxol6VG lFoTyXVYlhUKCMLvZLPAGfPqpH7NzBcvnTZ8vkeQeI3q4ixyo988ZhGJUAkV9LMK xyX+ncw2AbxbsCY4AITW9lY3TxbOcSZUVgZohRoo2tLX6RcgINRyCo/U9ia6543D 1+wzAkNpR9LunorTesIyBuJP/gcIL7f7eD91QwgvLbPZsbW/X4IpAzNMAdyKcTVH 5fx5MEpNJ7/cvVgV1vr//OARHZngVgl+4Q8H5bJKgRDUUtXgmIGOn4bYrm0PPT2k JGP6miSBqYMvCDWMXB5zZse6tu2hzpnZ34Lbn40PhDBRCm/ztjKzSS2H2E/+P0o1 NOcU5uZWSs4fJgzD0dDXpM/izJZmNdJgfnC1CDjcIQL+zVlMDVliEjqIqVrgECr6 rx7a1ZEdxa8emfv9/4yDapSIEmw6NP0MR+k6LJpQwde6iIsZ5HJaPJxjswZAFFWM sBX9E5/UmAipAiICtqILfiZYfIZ7u/c+9CLLxJn+qSS+i0pNtMWcvDzcZMPT+vAb n9kF2IUrGzfNIyrMIxaMXNwp8mnLJehmsZqYEYNfe5wCTvHHYO1htqwarBskoHrt DRl1q3nTkQkLE9SP4C6cKPQx6g2FiQ6Vk5So0INlwuYUr0l0357wggeD3DO2rY6C 3kudhghmdJv1Dy4xVa8E =Gol+ - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBVT2O0hLndAQH1ShLAQJ2ZA/9HzlgwIlAIIKCtII1YcCY3qx2nkT+xv50 ABuBmeOJRAB3crFLOaTS6s7wHJz9nBvJWeVsOJ2JWXQl8nmR2Jys4ovtkUth1+hm dmcPULYNtP5Cf/dPjjg5lQ8tAQT5tPyxB+R8ZbzuvNqifMmjvNvUUBdx5nR1gUiU z6lW7QIZBL1CFWQQxlOcViRoPnlCjhCyIZdEAlGH5S9N/PcNz/63s9XwMhwJjRrC am7a9GRrPujB+f/SE0ueBxXHcFPr5A6xvX9IYvH+9EyGFvLDsimiSJMq3ChvWdLp titxTeKFPuP3C1AzYQNl0VvDajU7DNS14ykyI1Pa3oG6ZijNHqU2mWaDX1xz7mN9 V9L//EirqmQ8HIyX5HcEBgFyS8mSP3BRHrerY3glLhEsDqUM6PFAYg+MBnYrUgSp FcPchAV1FVSa1cioCPxVaHN5nTppga5cVQlDZ94hbQ/372ZkZWFWEkU6LmCyYtqU GLtJPJal097KCNyee6snigyRmYMxiT659nvJaeuvy8FHW67DTTc7ExOTcy2iVrEg yzd1H0rqNf6XOHpunIJ7RiVAFucKxwwwlg8JV3/xbUgtJ0dc+RbVvfEMO2ZDf4Bz swf64MV/evPfo83BfoWpLccg+ePcduaOGJvbCQ7AIZ2nymf0ltECGI2f1L1iGaxg SF/afqyuUhI= =/I22 -----END PGP SIGNATURE-----