SB2015102110 - Ubuntu update for linux, linux-source-2.6.15
Published: October 21, 2015 Updated: October 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 17 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2009-2849)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The md driver (drivers/md/md.c) in the Linux kernel before 2.6.30.2 might allow local users to cause a denial of service (NULL pointer dereference) via vectors related to 'suspend_* sysfs attributes' and the (1) suspend_lo_store or (2) suspend_hi_store functions. NOTE: this is only a vulnerability when sysfs is writable by an attacker.
2) Resource management errors (CVE-ID: CVE-2009-3290)
CWE-ID: CWE-399 - Resource Management Errors
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to resource management errors error within the kvm_emulate_hypercall() function in arch/x86/kvm/x86.c. A local user can execute arbitrary code.
3) Memory corruption (CVE-ID: CVE-2009-3288)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The sg_build_indirect function in drivers/scsi/sg.c in Linux kernel 2.6.28-rc1 through 2.6.31-rc8 uses an incorrect variable when accessing an array, which allows local users to cause a denial of service (kernel OOPS and NULL pointer dereference), as demonstrated by using xcdroast to duplicate a CD. NOTE: this is only exploitable by users who can open the cdrom device.
4) Permissions, privileges, and access controls (CVE-ID: CVE-2009-3286)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read and manipulate data.
The vulnerability exists due to security restrictions bypass error within the nfsd_create_v3() function in fs/nfsd/vfs.c, within the do_open_lookup() function in fs/nfsd/nfs4proc.c, within the nfsd3_proc_create() function in fs/nfsd/nfs3proc.c. A local user can read and manipulate data.
5) Use of cryptographically weak pseudo-random number generator (prng) (CVE-ID: CVE-2009-3238)
CWE-ID: CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to use of cryptographically weak pseudo-random number generator (prng) error. A local user can gain access to sensitive information.
6) Information exposure (CVE-ID: CVE-2009-3002)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to information exposure error within the irda_getname() function in net/irda/af_irda.c. A local user can gain access to sensitive information.
7) Information exposure (CVE-ID: CVE-2009-3001)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to information exposure error within the llc_ui_getname() function in net/llc/af_llc.c. A local user can gain access to sensitive information.
8) NULL pointer dereference (CVE-ID: CVE-2009-2908)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The d_delete function in fs/ecryptfs/inode.c in eCryptfs in the Linux kernel 2.6.31 allows local users to cause a denial of service (kernel OOPS) and possibly execute arbitrary code via unspecified vectors that cause a 'negative dentry' and trigger a NULL pointer dereference, as demonstrated via a Mutt temporary directory in an eCryptfs mount.
9) Memory leak (CVE-ID: CVE-2009-2903)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak when handling IP tunnelled over DDP datagrams. A remote attacker can perform a denial of service attack.
10) Security restrictions bypass (CVE-ID: CVE-2009-1883)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read and manipulate data.
The z90crypt_unlocked_ioctl function in the z90crypt driver in the Linux kernel 2.6.9 does not perform a capability check for the Z90QUIESCE operation, which allows local users to leverage euid 0 privileges to force a driver outage.
11) Improper privilege management (CVE-ID: CVE-2009-2848)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read and manipulate data.
The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current->clear_child_tid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled, which is not properly handled during thread creation and exit.
12) Information exposure (CVE-ID: CVE-2009-2847)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to information exposure error within the kernel/signal.c. A local user can gain access to sensitive information.
13) Out-of-bounds read (CVE-ID: CVE-2009-2846)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to an out-of-bounds read error within the eisa_eeprom_read() function in drivers/parisc/eisa_eeprom.c. A remote non-authenticated attacker can gain access to sensitive information.
14) NULL pointer dereference (CVE-ID: CVE-2009-2767)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to NULL pointer dereference within the no_timer_create() and init_posix_timers() functions in kernel/posix-timers.c. A local user can execute arbitrary code.
15) Null pointer dereference (CVE-ID: CVE-2009-2698)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to null pointer dereference error. A local user can execute arbitrary code.
16) Memory corruption (CVE-ID: CVE-2009-2695)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page 0 and other low memory addresses, which allows local users to gain privileges by exploiting NULL pointer dereference vulnerabilities, related to (1) the default configuration of the allow_unconfined_mmap_low boolean in SELinux on Red Hat Enterprise Linux (RHEL) 5, (2) an error that causes allow_unconfined_mmap_low to be ignored in the unconfined_t domain, (3) lack of a requirement for the CAP_SYS_RAWIO capability for these mmap operations, and (4) interaction between the mmap_min_addr protection mechanism and certain application programs.
17) Integer overflow (CVE-ID: CVE-2009-2584)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
Off-by-one error in the options_write function in drivers/misc/sgi-gru/gruprocfs.c in the SGI GRU driver in the Linux kernel 2.6.30.2 and earlier on ia64 and x86 platforms might allow local users to overwrite arbitrary memory locations and gain privileges via a crafted count argument, which triggers a stack-based buffer overflow.
Remediation
Install update from vendor's website.