SB2015011007 - Ubuntu update for linux, linux-ec2

Description

This security bulletin contains information about 19 vulnerabilities.

1) Resource exhaustion (CVE-ID: CVE-2010-3698)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource exhaustion error. A local user can perform a denial of service (DoS) attack.

2) Use-after-free (CVE-ID: CVE-2014-0205)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing a crafted application that triggers a zero count. A local users can cause a denial of service (use-after-free and system crash) or possibly gain privileges.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

3) Information disclosure (CVE-ID: CVE-2010-4655)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability for an ethtool ioctl call.

4) Input validation error (CVE-ID: CVE-2010-4242)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows local users to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (NULL pointer dereference) via vectors related to the Bluetooth driver.

5) Integer overflow (CVE-ID: CVE-2010-4157)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow error. A local user can execute arbitrary code.

6) Missing initialization of resource (CVE-ID: CVE-2010-4081)

CWE-ID: CWE-909 - Missing initialization of resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to missing initialization of resource error within the snd_hdspm_hwdep_ioctl() function in sound/pci/rme9652/hdspm.c, within the snd_hdsp_hwdep_ioctl() function in sound/pci/rme9652/hdsp.c. A local user can gain access to sensitive information.

7) Information exposure (CVE-ID: CVE-2010-4080)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information exposure error within the snd_hdspm_hwdep_ioctl() function in sound/pci/rme9652/hdspm.c, within the snd_hdsp_hwdep_ioctl() function in sound/pci/rme9652/hdsp.c. A local user can gain access to sensitive information.

8) Information exposure (CVE-ID: CVE-2010-4072)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information exposure error within the copy_shmid_to_user() function in ipc/shm.c. A local user can gain access to sensitive information.

9) Information exposure (CVE-ID: CVE-2010-3861)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information exposure error. A local user can gain access to sensitive information.

10) Resource exhaustion (CVE-ID: CVE-2010-3858)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource exhaustion error. A local user can perform a denial of service (DoS) attack.

11) Input validation error (CVE-ID: CVE-2010-2537)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to damange or delete data.

The btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a (1) BTRFS_IOC_CLONE or (2) BTRFS_IOC_CLONE_RANGE ioctl call that specifies this file as a donor.

12) Improper Privilege Management (CVE-ID: CVE-2010-3301)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to the IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S  on the x86_64 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used. A local user can use the %rax register to escalate privileges on the system.

Note, the vulnerability exists due to a CVE-2007-4573 regression.

13) Information exposure (CVE-ID: CVE-2010-3298)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information exposure error. A local user can gain access to sensitive information.

14) Missing initialization of resource (CVE-ID: CVE-2010-3297)

CWE-ID: CWE-909 - Missing initialization of resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to missing initialization of resource error. A local user can gain access to sensitive information.

15) Information exposure (CVE-ID: CVE-2010-3296)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information exposure error. A local user can gain access to sensitive information.

16) Null pointer dereference (CVE-ID: CVE-2010-3079)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to null pointer dereference error. A local user can perform a denial of service (DoS) attack.

17) Improper input validation (CVE-ID: CVE-2010-2962)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to improper input validation error within the i915_gem_pread_ioctl(), i915_gem_gtt_pwrite_fast() and i915_gem_pwrite_ioctl() functions in drivers/gpu/drm/i915/i915_gem.c. A local user can execute arbitrary code.

18) Information exposure (CVE-ID: CVE-2010-2943)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to read and manipulate data.

The vulnerability exists due to information exposure error. A remote user can read and manipulate data.

19) Information exposure (CVE-ID: CVE-2010-2538)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information exposure error. A local user can gain access to sensitive information.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-1041-1