Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.1526.2
linux security update
28 June 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: kernel
Publisher: Debian
Operating System: Debian GNU/Linux 8
Debian GNU/Linux 9
Impact/Access: Root Compromise -- Existing Account
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2017-1000364 CVE-2017-9242 CVE-2017-9077
CVE-2017-9076 CVE-2017-9075 CVE-2017-9074
CVE-2017-8925 CVE-2017-8924 CVE-2017-8890
CVE-2017-8064 CVE-2017-7895 CVE-2017-7645
CVE-2017-7487 CVE-2017-0605
Reference: ESB-2017.1304
ESB-2017.1179
Original Bulletin:
http://www.debian.org/security/2017/dsa-3886
Revision History: June 28 2017: The security update announced as DSA-3886-1 caused regressions for some applications using Java - including jsvc, LibreOffice and Scilab - due to the fix for CVE-2017-1000364.
June 20 2017: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3886-2 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
June 27, 2017 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : linux
Debian Bug : 865303
The security update announced as DSA-3886-1 caused regressions for some
applications using Java - including jsvc, LibreOffice and Scilab - due
to the fix for CVE-2017-1000364. Updated packages are now available to
correct this issue. For reference, the relevant part of the original
advisory text follows.
CVE-2017-1000364
The Qualys Research Labs discovered that the size of the stack guard
page is not sufficiently large. The stack-pointer can jump over the
guard-page and moving from the stack into another memory region
without accessing the guard-page. In this case no page-fault
exception is raised and the stack extends into the other memory
region. An attacker can exploit this flaw for privilege escalation.
The default stack gap protection is set to 256 pages and can be
configured via the stack_guard_gap kernel parameter on the kernel
command line.
Further details can be found at
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
For the oldstable distribution (jessie), this problem has been fixed
in version 3.16.43-2+deb8u2.
For the stable distribution (stretch), this problem has been fixed in
version 4.9.30-2+deb9u2.
We recommend that you upgrade your linux packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAllSsjxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0Q7Bw//Sdd+3lkJjSOUvuFOVpyrXR6zGgCW4+iQEDkTtfit5NZ5Uwa+89gQ3akJ
CRvYJ55aCVc/LCrBpxaGhI0lb8kUSK4dLFTPnC+zm5SJF4XbXCCYhS3+UAC85Imo
ElRMySUDEmbHLsnUvdcWAjcBmgV06asT2Ia+QsaGajLMf/+5reDI1D/MNXb8AI8M
mnCgSOIlSy4neZTxKwmyYHtdMfrKMTYbXMG9zUfrM7jsOfbn6KvsaPWTdP1+5EBO
lPrHrNkVzA8VUrO9sje82/kLpfl4cYPYlEoQfaXQUogrKuvMkJ0gOn858OqdD038
nbItnvdcmbHsFMckhykOOheL3Iin3QxOWHBK93MZCZseubNAphrkqFV5+omki5eD
+M1UkvR15dPBilub0l+a8cVUIO2TY2yJSSaDZgTEPepuyTbOxCc0hvwNoqdG0hH6
gD6edfWJ1TNiDVD1pW9SGRF0QIf+HyoKhEVGyuJfJQtRe4hdgCcKxu2VAGbpdqul
qIlu4UaQhzclx4P2urIRR+HRMX6K61IAj3mxuItUkP+Xa+xxTby2soGRH6Q9IMHc
iqgdYZmmWe3gc21I8BaKclefDP8tNJgHiLr7j+CwQawzuj3lWHJ9ZmXx0EfU1VJT
ZYbZthQ7XChu5fI6uRfmGWMocE3700HzQDtb6/NFRnsElxlx5L4=
=VAqb
- -----END PGP SIGNATURE-----
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3886-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
June 19, 2017 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : linux
CVE ID : CVE-2017-0605 CVE-2017-7487 CVE-2017-7645 CVE-2017-7895
CVE-2017-8064 CVE-2017-8890 CVE-2017-8924 CVE-2017-8925
CVE-2017-9074 CVE-2017-9075 CVE-2017-9076 CVE-2017-9077
CVE-2017-9242 CVE-2017-1000364
Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.
CVE-2017-0605
A buffer overflow flaw was discovered in the trace subsystem.
CVE-2017-7487
Li Qiang reported a reference counter leak in the ipxitf_ioctl
function which may result into a use-after-free vulnerability,
triggerable when a IPX interface is configured.
CVE-2017-7645
Tuomas Haanpaa and Matti Kamunen from Synopsys Ltd discovered that
the NFSv2 and NFSv3 server implementations are vulnerable to an
out-of-bounds memory access issue while processing arbitrarily long
arguments sent by NFSv2/NFSv3 PRC clients, leading to a denial of
service.
CVE-2017-7895
Ari Kauppi from Synopsys Ltd discovered that the NFSv2 and NFSv3
server implementations do not properly handle payload bounds
checking of WRITE requests. A remote attacker with write access to a
NFS mount can take advantage of this flaw to read chunks of
arbitrary memory from both kernel-space and user-space.
CVE-2017-8064
Arnd Bergmann found that the DVB-USB core misused the device
logging system, resulting in a use-after-free vulnerability, with
unknown security impact.
CVE-2017-8890
It was discovered that the net_csk_clone_lock() function allows a
remote attacker to cause a double free leading to a denial of
service or potentially have other impact.
CVE-2017-8924
Johan Hovold found that the io_ti USB serial driver could leak
sensitive information if a malicious USB device was connected.
CVE-2017-8925
Johan Hovold found a reference counter leak in the omninet USB
serial driver, resulting in a use-after-free vulnerability. This
can be triggered by a local user permitted to open tty devices.
CVE-2017-9074
Andrey Konovalov reported that the IPv6 fragmentation
implementation could read beyond the end of a packet buffer. A
local user or guest VM might be able to use this to leak sensitive
information or to cause a denial of service (crash).
CVE-2017-9075
Andrey Konovalov reported that the SCTP/IPv6 implementation
wrongly initialised address lists on connected sockets, resulting
in a use-after-free vulnerability, a similar issue to
CVE-2017-8890. This can be triggered by any local user.
CVE-2017-9076 / CVE-2017-9077
Cong Wang found that the TCP/IPv6 and DCCP/IPv6 implementations
wrongly initialised address lists on connected sockets, a similar
issue to CVE-2017-9075.
CVE-2017-9242
Andrey Konovalov reported a packet buffer overrun in the IPv6
implementation. A local user could use this for denial of service
(memory corruption; crash) and possibly for privilege escalation.
CVE-2017-1000364
The Qualys Research Labs discovered that the size of the stack guard
page is not sufficiently large. The stack-pointer can jump over the
guard-page and moving from the stack into another memory region
without accessing the guard-page. In this case no page-fault
exception is raised and the stack extends into the other memory
region. An attacker can exploit this flaw for privilege escalation.
The default stack gap protection is set to 256 pages and can be
configured via the stack_guard_gap kernel parameter on the kernel
command line.
Further details can be found at
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
For the oldstable distribution (jessie), these problems have been fixed
in version 3.16.43-2+deb8u1.
For the stable distribution (stretch), these problems have been fixed in
version 4.9.30-2+deb9u1 or earlier versions before the stretch release.
We recommend that you upgrade your linux packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAllH7wxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0R38w/+MgLDpftRSRxAsR0QMJwt89Kmp8aw4X8NnUF2epaR0gSERD45BB9iB8Em
0QsP0hPqJZwmTDelo54EOKuJjcXEtAgHBLBAJj7AvGIJz1MKiJcsUQJItVUr6itA
KjJtab8IFYkXxg3aL3UiSed0+eWO+ODNuFk251/dvdYLv/IRGXfep24978ktM1mj
Gykywmvr9eOaSlRfr/cHYuO6v0No5wL8OGiPM+abl9i8lN/dXxllEEQEUm+me6O6
pnrBk0bGOh3fQS/lqhiv4q/T3V5ux56jgj/iu4L3YF3Neui/oc1Ip8wTPGhj/JuJ
4rwjoHSXRSLtHHModfL3O92Atu5n74ZjpbCpZnu/BMxwcqq8NxrOpht1dbB77auM
vkVtcKY7/fmlwgkbK2KQGmLmzcSxXN9GymR26DAVZbetWyLDoxkIrPJeamWK2I+T
A+cDBnx2QEzXazi7H73CqLREp11AndWRIqnHs1urVfa6Q3RUQG7zwg7MCEMP0vhv
qFsXLW3B6kNQPa9ptM+Y/cNHz4+5GfEI5eeoEQ4pw+4uopxRhCJwQ0/SiaSXG1vZ
2Pj9U0qOo7iDLCAKDWFDdCze4msPyOBoNKcxkbTz+EB5RQy3amXbexavjmXcWZ/4
GfRnMkwwFVlIN1rF9Vu/ehhi8iYDilL8+3gVgX2QyKlHYbS30dg=
=cr+H
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWVMTZIx+lLeg9Ub1AQioKw/+Kky8AlZwoFjZAAY2EFok+Jo6P9Lh/DHv
CUYj14hWKaLg09W8yp8EASYg1aMgzvcJHTUPzWuhe67SV06c8DkWePIMEt4optpL
KOhyf70N1UfvO3GsH2ox18Q0dyyiJvy+t6l+UOv0pfFsVyUfvfui7PbiMek7VKRF
I+VgNXyMcpHiF6fXSPHMKfoJyEqG+nKbSh5xlffNsNtH7u7fBHmjGEK0Ii0RFvWg
IzRdAzyaRW1GBgYG/F8EI+dvXSyy00DDspUrwbtYk2sdKCPXpowPEidAIifJEWmp
sWJ73zg6TFzLaBaIJJd/gFpR+idm2+RAQuHHvig8bCx2OTcSaz169GzbO/zCTzSW
N832Ts67rj6kdFkW6a5apNs9fW/ubGB1z4Zci+0V1uWw1a4wokUoEwAv9F2T+oAk
3n028Fcef3u6QMxCJbETFt7zLx549e8HHgagkG1yrlLTUwSxYZrQHG/G97Q8QaG7
53lJlpwFbaKvEPjxZ/IPfd0tLLRuxdwsHOGQunXUr3brf0XfB2NyneZ/lFna5Thl
LQ18/hqopA0/dP6DeGSmLCP6ktqkhDsurDPJwxkqzNczJ6kJwqFGNQ0xeoW6VHpu
Rak05BK+qPTmr/vpYg3OBe3wPHKFH62y8k6W/IbLOWaq/H6POt/1fbx9oWVgoHu2
UlPCDM7idoc=
=S+Wn
-----END PGP SIGNATURE-----