Fedora 24 update for kernel

1) Integer overflow

EUVDB-ID: #VU91182

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-5576

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the vc4_get_bcl() function in drivers/gpu/drm/vc4/vc4_gem.c. A local user can execute arbitrary code.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 24

kernel: before 4.9.6-100.fc24

CPE2.3

• cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:kernel:*:*:*:*:*:fedora:*:*

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6cc158c193

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Null pointer dereference

EUVDB-ID: #VU7254

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-5577

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists due to the failure to set an errno value upon certain overflow detections by the vc4_get_bcl function in drivers/gpu/drm/vc4/vc4_gem.c. A local attacker can use a VC4_SUBMIT_CL ioctl system call with inconsistent size values to trigger NULL pointer dereference and cause the system to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 24

kernel: before 4.9.6-100.fc24

CPE2.3

• cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:kernel:*:*:*:*:*:fedora:*:*

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6cc158c193

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource management error

EUVDB-ID: #VU39739

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-10153

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local authenticated user to execute arbitrary code.

The crypto scatterlist API in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging reliance on earlier net/ceph/crypto.c code.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 24

kernel: before 4.9.6-100.fc24

CPE2.3

• cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:kernel:*:*:*:*:*:fedora:*:*

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6cc158c193

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU39740

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-10154

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

The smbhash function in fs/cifs/smbencrypt.c in the Linux kernel 4.9.x before 4.9.1 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a scatterlist.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 24

kernel: before 4.9.6-100.fc24

CPE2.3

• cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:kernel:*:*:*:*:*:fedora:*:*

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6cc158c193

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Buffer overflow

EUVDB-ID: #VU39737

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-5547

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local authenticated user to execute arbitrary code.

drivers/hid/hid-corsair.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 24

kernel: before 4.9.6-100.fc24

CPE2.3

• cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:kernel:*:*:*:*:*:fedora:*:*

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6cc158c193

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Buffer overflow

EUVDB-ID: #VU39738

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-5548

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local authenticated user to execute arbitrary code.

drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 24

kernel: before 4.9.6-100.fc24

CPE2.3

• cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:kernel:*:*:*:*:*:fedora:*:*

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6cc158c193

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Information exposure through log files

EUVDB-ID: #VU92440

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-5549

CWE-ID: CWE-532 - Information Exposure Through Log Files

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information exposure through log files error within the klsi_105_get_line_state() function in drivers/usb/serial/kl5kusb105.c. A local user can gain access to sensitive information.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 24

kernel: before 4.9.6-100.fc24

CPE2.3

• cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:kernel:*:*:*:*:*:fedora:*:*

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6cc158c193

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Off-by-one

EUVDB-ID: #VU91177

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-5550

CWE-ID: CWE-193 - Off-by-one Error

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to an off-by-one error within the iov_iter_copy_from_user_atomic() and iov_iter_pipe() functions in lib/iov_iter.c. A local user can gain access to sensitive information.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 24

kernel: before 4.9.6-100.fc24

CPE2.3

• cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:kernel:*:*:*:*:*:fedora:*:*

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6cc158c193

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improper privilege management

EUVDB-ID: #VU93742

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-5551

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

Description

The vulnerability allows a local user to read and manipulate data.

The vulnerability exists due to improperly imposed permissions within the simple_set_acl() function in fs/posix_acl.c. A local user can read and manipulate data.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 24

kernel: before 4.9.6-100.fc24

CPE2.3

• cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:kernel:*:*:*:*:*:fedora:*:*

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6cc158c193

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Privilege escalation

EUVDB-ID: #VU5388

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-7097

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to the setgid bit being preserved during a setxattr call by the filesystem implementation. A local attacker can leverage the existence of a setgid program to gain group privileges.

Successful exploitation of the vulnerability results in privileges escalation.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 24

kernel: before 4.9.6-100.fc24

CPE2.3

• cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:kernel:*:*:*:*:*:fedora:*:*

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-6cc158c193

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.