Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.0106
Debian linux security update
10 January 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: kernel
Publisher: Debian
Operating System: Debian GNU/Linux 8
Impact/Access: Root Compromise -- Existing Account
Access Privileged Data -- Existing Account
Denial of Service -- Existing Account
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2017-1000410 CVE-2017-1000407 CVE-2017-17807
CVE-2017-17806 CVE-2017-17805 CVE-2017-17741
CVE-2017-17558 CVE-2017-17450 CVE-2017-17449
CVE-2017-17448 CVE-2017-16939 CVE-2017-16538
CVE-2017-15868 CVE-2017-8824 CVE-2017-5754
Reference: ASB-2018.0002.4
ESB-2018.0102
ESB-2018.0096
ESB-2018.0044
ESB-2018.0012
ESB-2017.3259
Original Bulletin:
http://www.debian.org/security/2018/dsa-4082
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4082-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
January 09, 2018 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : linux
CVE ID : CVE-2017-5754 CVE-2017-8824 CVE-2017-15868 CVE-2017-16538
CVE-2017-16939 CVE-2017-17448 CVE-2017-17449 CVE-2017-17450
CVE-2017-17558 CVE-2017-17741 CVE-2017-17805 CVE-2017-17806
CVE-2017-17807 CVE-2017-1000407 CVE-2017-1000410
Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.
CVE-2017-5754
Multiple researchers have discovered a vulnerability in Intel
processors, enabling an attacker controlling an unprivileged
process to read memory from arbitrary addresses, including from
the kernel and all other processes running on the system.
This specific attack has been named Meltdown and is addressed in
the Linux kernel for the Intel x86-64 architecture by a patch set
named Kernel Page Table Isolation, enforcing a near complete
separation of the kernel and userspace address maps and preventing
the attack. This solution might have a performance impact, and can
be disabled at boot time by passing `pti=off' to the kernel
command line.
CVE-2017-8824
Mohamed Ghannam discovered that the DCCP implementation did not
correctly manage resources when a socket is disconnected and
reconnected, potentially leading to a use-after-free. A local
user could use this for denial of service (crash or data
corruption) or possibly for privilege escalation. On systems that
do not already have the dccp module loaded, this can be mitigated
by disabling it:
echo >> /etc/modprobe.d/disable-dccp.conf install dccp false
CVE-2017-15868
Al Viro found that the Bluebooth Network Encapsulation Protocol
(BNEP) implementation did not validate the type of the second
socket passed to the BNEPCONNADD ioctl(), which could lead to
memory corruption. A local user with the CAP_NET_ADMIN capability
can use this for denial of service (crash or data corruption) or
possibly for privilege escalation.
CVE-2017-16538
Andrey Konovalov reported that the dvb-usb-lmedm04 media driver
did not correctly handle some error conditions during
initialisation. A physically present user with a specially
designed USB device can use this to cause a denial of service
(crash).
CVE-2017-16939
Mohamed Ghannam reported (through Beyond Security's SecuriTeam
Secure Disclosure program) that the IPsec (xfrm) implementation
did not correctly handle some failure cases when dumping policy
information through netlink. A local user with the CAP_NET_ADMIN
capability can use this for denial of service (crash or data
corruption) or possibly for privilege escalation.
CVE-2017-17448
Kevin Cernekee discovered that the netfilter subsystem allowed
users with the CAP_NET_ADMIN capability in any user namespace, not
just the root namespace, to enable and disable connection tracking
helpers. This could lead to denial of service, violation of
network security policy, or have other impact.
CVE-2017-17449
Kevin Cernekee discovered that the netlink subsystem allowed
users with the CAP_NET_ADMIN capability in any user namespace
to monitor netlink traffic in all net namespaces, not just
those owned by that user namespace. This could lead to
exposure of sensitive information.
CVE-2017-17450
Kevin Cernekee discovered that the xt_osf module allowed users
with the CAP_NET_ADMIN capability in any user namespace to modify
the global OS fingerprint list.
CVE-2017-17558
Andrey Konovalov reported that that USB core did not correctly
handle some error conditions during initialisation. A physically
present user with a specially designed USB device can use this to
cause a denial of service (crash or memory corruption), or
possibly for privilege escalation.
CVE-2017-17741
Dmitry Vyukov reported that the KVM implementation for x86 would
over-read data from memory when emulating an MMIO write if the
kvm_mmio tracepoint was enabled. A guest virtual machine might be
able to use this to cause a denial of service (crash).
CVE-2017-17805
Dmitry Vyukov reported that the KVM implementation for x86 would
over-read data from memory when emulating an MMIO write if the
kvm_mmio tracepoint was enabled. A guest virtual machine might be
able to use this to cause a denial of service (crash).
CVE-2017-17806
It was discovered that the HMAC implementation could be used with
an underlying hash algorithm that requires a key, which was not
intended. A local user could use this to cause a denial of
service (crash or memory corruption), or possibly for privilege
escalation.
CVE-2017-17807
Eric Biggers discovered that the KEYS subsystem lacked a check for
write permission when adding keys to a process's default keyring.
A local user could use this to cause a denial of service or to
obtain sensitive information.
CVE-2017-1000407
Andrew Honig reported that the KVM implementation for Intel
processors allowed direct access to host I/O port 0x80, which
is not generally safe. On some systems this allows a guest
VM to cause a denial of service (crash) of the host.
CVE-2017-1000410
Ben Seri reported that the Bluetooth subsystem did not correctly
handle short EFS information elements in L2CAP messages. An
attacker able to communicate over Bluetooth could use this to
obtain sensitive information from the kernel.
For the oldstable distribution (jessie), these problems have been fixed
in version 3.16.51-3+deb8u1.
We recommend that you upgrade your linux packages.
For the detailed security status of linux please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/linux
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlpU5cRfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0Qsnw//euNWKwOR4R+JFEyKECrS5GHFzLdj1kpion3oGGZyyJ8VjmVv+MombQPk
xk17ge5QWl44CMzXlkE6QREdrXQfed49us9O6CzS2BPwV/QWsoUc7WLmqYD0OQmh
c5/RqvkzUfXzEJ7efLzChXAs94RB0A9kOKoRxNrXfdhvevM+FumB17dErIrT2nxP
KcX3Tyh05twrJqCnbNIo189LDexKfEyAN9pnwBekknzXB0V3zmvPwebVz85v1I8p
aiWSXX9EjWvVeZG31XDOysEcrwO4T71zqCgPxPeurAOVTJNvK0B8je7wFBD9ayoy
PFNdykxRUBA9rBJ8Aoi3zcZBJYxTYBzOKDUkPaO/80mflsN6yDCaWwQ+antyuQ8y
jO02bAEZiKmpsuclKvK48rfvtoFqXsp6WhO1NoWnmpFvsxXN0DdqKRB60rycrMMA
Q2wLYnPX2QNRNdxtkJ0D380VkTdPjJT4yOPM4UuIJ1S7jwzVcQKnu8VswdFey0nq
k42DigyVQryZd1elqiyGWWtNkJ9BRscSgkpCAfEUo2XCR61wEXu7aOHGksPuTTZr
2FJGIa4OR1dAc2pPGy7CUWYnloGwSCCq7F85bi6v5KG7YnHlic/XnJva+hT+0lGT
1HQlCKU9bicaLL0GIK9Qt5vaUseZLWiOXMHU6JKvo/y6AL3FHnI=
=Ozoc
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWlV4Fox+lLeg9Ub1AQhf+g//QxgPel8DYV+adkICJEcy4+g2+g60tVMN
JmwksUmH3Yh0pJ+98miYid6NeoDQ7Q29Mh9NqLRWEiBiJa/6rDdcgLBrz7Ro873Z
8CsVX2KGAC9fVzRKS3Hj+YCreCjlIk5fa/9xUW3+WB3gjbPPFfp9sDzfTN/LToDO
/1DodRX97yRXQ4Seo0ojrSqbnLmophlMRjlljJdIZyF3P/WXneShjyxuVZV7VA16
4Jmj2q4fg7QeJdtGSC0hZaehOOIJQybGbzXfBT6VUNnA31T6c3IV0puENBrXNPws
2COHVgpJKmwsd8QaMINs97N6fX3rjK0wJN/dfWmMIRdPbRFsPK0dkFkFO7+NUkNU
RWVT7nfW7Kuz1XJeHiMRa6V9OrsnHxdkGNI6hsqYkT4IzWWNeHNPc+gj36I14T/0
VjRlONR1Zz4vPiOrXRPFw8I3S3ko1cMQC8yDlz19Kv0H+zhglJ9oBOsGJI8GczPj
bOoDzmrOgk9pt5J5Wgo9ZfP32+yIYJQxajD5SW2k9WGxyeczChwahn8l9/i4iMsz
kPLDc4+FMs1amHchrdsHw0B8MFhowQ8zB8+CzqLyDYyyHoqYfb2ENBnZYuQA5tr9
ooM0R6kM+PU3X3llV9PPxz7tPY5FYLTrpFo/VYrCnz1asuWI2VE6aRyoB9kv7hbE
3nX8bARCorQ=
=guej
-----END PGP SIGNATURE-----