Multiple vulnerabilities in Linux Kernel



Published: 2016-10-27 | Updated: 2018-05-23
Risk Low
Patch available YES
Number of vulnerabilities 8
CVE-ID CVE-2016-10318
CVE-2016-0758
CVE-2016-7097
CVE-2016-7042
CVE-2016-7039
CVE-2016-8630
CVE-2016-4565
CVE-2015-8970
CWE-ID CWE-862
CWE-190
CWE-264
CWE-131
CWE-400
CWE-476
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Linux kernel
Operating systems & Components / Operating system

linux_kernel (Debian package)
Operating systems & Components / Operating system package or component

Vendor Linux Foundation
Debian

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) Missing authorization

EUVDB-ID: #VU12316

Risk: Medium

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-10318

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the fscrypt_process_policy function in fs/crypto/policy.c in the ext4 and f2fs filesystem encryption support due to missing authorization check. A remote attacker can assign an encryption policy to a directory owned by a different user and cause the service to crash.

Mitigation

Update to version 4.7.4.

Vulnerable software versions

Linux kernel: 4.7.0 - 4.7.3


CPE2.3 External links

http://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=163ae1c6ad6299b19e22b4...

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Integer overflow

EUVDB-ID: #VU456

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-0758

CWE-ID: CWE-190 - Integer Overflow or Wraparound

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in lib/asn1_decoder.c due to integer overflow. A local attacker can submit specially crafted ASN.1 data and gain root privileges.

Mitigation

Update to version 4.6.

Vulnerable software versions

Linux kernel: 4.5.0 - 4.5.7


CPE2.3 External links

http://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=23c8a812dc3c621009e4f0...

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Privilege escalation

EUVDB-ID: #VU5388

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7097

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to the setgid bit being preserved during a setxattr call by the filesystem implementation. A local attacker can leverage the existence of a setgid program to gain group privileges.

Successful exploitation of the vulnerability results in privileges escalation.

Mitigation

Update to version 4.9.6.

Vulnerable software versions

Linux kernel: 4.0.1 - 4.8.2


CPE2.3 External links

http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.6
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.37

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Denial of service

EUVDB-ID: #VU1012

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7042

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

Exploit availability: No

Description

The vulnerability allows a local user to cause DoS conditions on the target system.
The weakness exists due to using of incorrect buffer size for certain timeout data by the proc_keys_show function in security/keys/proc.c while enabling of GNU Compiler Collection (gcc) stack protector. By reading the /proc/keys file attackers can trigger stack memory corruption.
Successful exploitation of the vulnerability may result in denial of service on the vulnerable system.

Mitigation

Update to version 4.8.2.

Vulnerable software versions

Linux kernel: 3.2.78-1 - 4.8.1

linux_kernel (Debian package): 4.7.2-1


CPE2.3 External links

http://bugzilla.redhat.com/show_bug.cgi?id=1373966

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Resource exhaustion

EUVDB-ID: #VU1174

Risk: Medium

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7039

CWE-ID: CWE-400 - Uncontrolled Resource Consumption ('Resource Exhaustion')

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the IP stack due to stack consumption. A remote attacker can trigger use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, and cause the service to crash.

Mitigation

Update to version 4.8.3.

Vulnerable software versions

Linux kernel: 4.1.1 - 4.8.2


CPE2.3 External links

http://www.openwall.com/lists/oss-security/2016/10/10/15
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.37

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) NULL pointer dereference

EUVDB-ID: #VU1171

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-8630

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the x86_decode_insn function in arch/x86/kvm/emulate.c due to NULL pointer dereference when KVM is enabled. A local attacker can cause the service to crash via a certain use of a ModR/M byte in an undefined instruction.

Mitigation

Update to version 4.8.7.

Vulnerable software versions

Linux kernel: 4.8 - 4.8.6


CPE2.3 External links

http://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d9092f52d7e61dd1557f2d...

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Privilege escalation

EUVDB-ID: #VU3829

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-4565

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition or gain elevated privileges on the target system.

The weakness exists due to it incorrectly relies on the write system call. A local attacker can cause the service to crash or gain root privileges.

Mitigation

Update to version 4.5.3.

Vulnerable software versions

Linux kernel: 4.5.0 - 4.5.2


CPE2.3 External links

http://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Null pointer dereference

EUVDB-ID: #VU8116

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-8970

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists due to crypto/algif_skcipher.c in the Linux kernel does not verify that a setkey operation has been performed on an AF_ALG socket before an accept system call is processed. A local attacker can provide a specially crafted application that does not supply a key, related to the lrw_crypt function in crypto/lrw.c., trigger NULL pointer dereference and cause the system to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Update to version 4.5.

Vulnerable software versions

Linux kernel: 4.0.1 - 4.4.86


CPE2.3 External links

http://www.openwall.com/lists/oss-security/2016/11/04/3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###