Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2016.0579 linux security update 4 March 2016 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: kernel Publisher: Debian Operating System: Debian GNU/Linux 7 Debian GNU/Linux 8 Impact/Access: Increased Privileges -- Console/Physical Denial of Service -- Remote/Unauthenticated Access Confidential Data -- Console/Physical Resolution: Patch/Upgrade CVE Names: CVE-2016-2550 CVE-2016-2549 CVE-2016-2548 CVE-2016-2547 CVE-2016-2546 CVE-2016-2545 CVE-2016-2544 CVE-2016-2543 CVE-2016-2384 CVE-2016-2069 CVE-2016-0774 CVE-2016-0723 CVE-2015-8830 CVE-2015-8816 CVE-2015-8812 CVE-2015-8785 CVE-2015-8767 CVE-2015-7566 CVE-2015-1805 CVE-2013-4312 Reference: ASB-2016.0017 ESB-2016.0273 ESB-2016.0137 ESB-2015.2640 Original Bulletin: http://www.debian.org/security/2016/dsa-3503 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - - ------------------------------------------------------------------------- Debian Security Advisory DSA-3503-1 security@debian.org https://www.debian.org/security/ Ben Hutchings March 03, 2016 https://www.debian.org/security/faq - - ------------------------------------------------------------------------- Package : linux CVE ID : CVE-2013-4312 CVE-2015-7566 CVE-2015-8767 CVE-2015-8785 CVE-2015-8812 CVE-2015-8816 CVE-2015-8830 CVE-2016-0723 CVE-2016-0774 CVE-2016-2069 CVE-2016-2384 CVE-2016-2543 CVE-2016-2544 CVE-2016-2545 CVE-2016-2546 CVE-2016-2547 CVE-2016-2548 CVE-2016-2549 CVE-2016-2550 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, information leak or data loss. CVE-2013-4312 Tetsuo Handa discovered that users can use pipes queued on local (Unix) sockets to allocate an unfair share of kernel memory, leading to denial-of-service (resource exhaustion). This issue was previously mitigated for the stable suite by limiting the total number of files queued by each user on local sockets. The new kernel version in both suites includes that mitigation plus limits on the total size of pipe buffers allocated for each user. CVE-2015-7566 Ralf Spenneberg of OpenSource Security reported that the visor driver crashes when a specially crafted USB device without bulk-out endpoint is detected. CVE-2015-8767 An SCTP denial-of-service was discovered which can be triggered by a local attacker during a heartbeat timeout event after the 4-way handshake. CVE-2015-8785 It was discovered that local users permitted to write to a file on a FUSE filesystem could cause a denial of service (unkillable loop in the kernel). CVE-2015-8812 A flaw was found in the iw_cxgb3 Infiniband driver. Whenever it could not send a packet because the network was congested, it would free the packet buffer but later attempt to send the packet again. This use-after-free could result in a denial of service (crash or hang), data loss or privilege escalation. CVE-2015-8816 A use-after-free vulnerability was discovered in the USB hub driver. This may be used by a physically present user for privilege escalation. CVE-2015-8830 Ben Hawkes of Google Project Zero reported that the AIO interface permitted reading or writing 2 GiB of data or more in a single chunk, which could lead to an integer overflow when applied to certain filesystems, socket or device types. The full security impact has not been evaluated. CVE-2016-0723 A use-after-free vulnerability was discovered in the TIOCGETD ioctl. A local attacker could use this flaw for denial-of-service. CVE-2016-0774 It was found that the fix for CVE-2015-1805 in kernel versions older than Linux 3.16 did not correctly handle the case of a partially failed atomic read. A local, unprivileged user could use this flaw to crash the system or leak kernel memory to user space. CVE-2016-2069 Andy Lutomirski discovered a race condition in flushing of the TLB when switching tasks on an x86 system. On an SMP system this could possibly lead to a crash, information leak or privilege escalation. CVE-2016-2384 Andrey Konovalov found that a crafted USB MIDI device with an invalid USB descriptor could trigger a double-free. This may be used by a physically present user for privilege escalation. CVE-2016-2543 Dmitry Vyukov found that the core sound sequencer driver (snd-seq) lacked a necessary check for a null pointer, allowing a user with access to a sound sequencer device to cause a denial-of- service (crash). CVE-2016-2544, CVE-2016-2546, CVE-2016-2547, CVE-2016-2548 Dmitry Vyukov found various race conditions in the sound subsystem (ALSA)'s management of timers. A user with access to sound devices could use these to cause a denial-of-service (crash or hang) or possibly for privilege escalation. CVE-2016-2545 Dmitry Vyukov found a flaw in list manipulation in the sound subsystem (ALSA)'s management of timers. A user with access to sound devices could use this to cause a denial-of-service (crash or hang) or possibly for privilege escalation. CVE-2016-2549 Dmitry Vyukov found a potential deadlock in the sound subsystem (ALSA)'s use of high resolution timers. A user with access to sound devices could use this to cause a denial-of-service (hang). CVE-2016-2550 The original mitigation of CVE-2013-4312, limiting the total number of files a user could queue on local sockets, was flawed. A user given a local socket opened by another user, for example through the systemd socket activation mechanism, could make use of the other user's quota, again leading to a denial-of-service (resource exhaustion). This is fixed by accounting queued files to the sender rather than the socket opener. For the oldstable distribution (wheezy), these problems have been fixed in version 3.2.73-2+deb7u3. The oldstable distribution (wheezy) is not affected by CVE-2015-8830. For the stable distribution (jessie), these problems have been fixed in version 3.16.7-ckt20-1+deb8u4. CVE-2015-7566, CVE-2015-8767 and CVE-2016-0723 were already fixed in DSA-3448-1. CVE-2016-0774 does not affect the stable distribution. We recommend that you upgrade your linux packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJW2KI+AAoJEAVMuPMTQ89EPC0QAIOa9DAMLE0Qx5LDOlfE2Y5S 3NjOMYW+pNZF/lGigntpkqjioU+TgOqOrjgJkKVygejmRqjrWwWJg689HgOnRoeC CPNi3VJdpZ1iNSiU5I0R4/OeGIziAgRHhyWwDqtKk2I4IrKIXRe6SAzA8L+XmsC2 iL2uCjqu8ReRAexMNjr1/7nJX7gQbnTQBPwyaV7KahzdyktMWA2wW4F0YyEWakgp Bd4H0xuGeSlC6VjD2Lj026hwN65F+yYxWg8J/jGspWi4rMB4AjHQCQ9EVzjdK9lr jjqDsh90A1zUV3LSx3P1pDn6vsRqj4fGiFByfbUWvoB+AgtSyP9qbzmD2O4nG4Zn LwsCcMYAr0MRz0DZpLSXFGd62wYIVnromHXdARyIGBrziVE5a5zve3Wr0V62TrFg kdg8L0pCVqGS4OvKjPWG0nvMF3fuoZ2+jp88Pk3jHoRf+qUA6mWpSrwkUrwkI+NB vy7+Fk10rgLkPrnkCOG4XGV2A0rYJHXvulSOjGOT+S1XsobN6YK7BX06G4vWx2ao cZXtUqbDwWZ4HYlXYzWcVtChmAmqHle3X651xisj3ifHjOfO4+XC5COGXyjR8BIb 1FZ9AvS3lCN6NUqQb5a+0itd2yiO3emTGAyGP+vttQ8Z6v78hu4RnyTNl98zRirW PIAuU3pudWJPfYLr57T9 =KF0m - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBVtjf336ZAP0PgtI9AQI+Jg//UR1QLZkFKOOGyBQW/L2P9YJNHnwBLjMX hjL7Kt4GAYtoIxIdXgvdGQMGLNvqRgLFaHThNy4rQnm1t2jCq82GfKQZz2zcO8ku wSjDDy1LuQ9JGa4W5WhyUTbpK8bDWncGQRhfPT12byJ98PpD1IdTcipfAZfk7Yww Xk0y/4lfMpE/QdN/3YHj77As1hkJlyxf7fLCr7cGQ0SpIl8RqOXjyj1hOz5zMdUV HZhWwkIGxeBNj+jI3EG/jyc6WuBA3r4zBOCVOZuqGnR8AaE7ywpY0ThzEJszKTB0 jMRKzxuFNQQeEpnjvKFQv9XwWymC+zEaifnDLUZTAUZ1j50eOhG6TvN7kksc3fPT nzC5PvipT1zlU3RntfLMMDrTI6g5FotkVpNiYLYm0xLP8oIfS5TpveaiBz0cpfat H/OZFGyezi2VaEY35YD1/tBUwYA9+2lz9iRIFsOb4OuQzK6X6AbWhlDnYPDfxeTy F6sfRlfP+HH306vBGjOAr7HYq1J9NmhW8Nn7b95zLTbzHWAmfbgUckZTP7OGI9nK mmdPBHVyeSQaY1w+o1tdTyHatn+3shMBsF1MmVYUXr8Sczgfy8B7Wkik0kHvTlSr gMWjeuFW4eMuBjgz6IaRPRNuxR5Sh83g4ypKqt9/E8v6VTumaDc9oBPP0bjCy6CL bRYyV9bA6Io= =weVS -----END PGP SIGNATURE-----