SB2017020319 - Ubuntu update for linux

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017020319

SB2017020319 - Ubuntu update for linux

Published: February 3, 2017 Updated: October 31, 2026

Security Bulletin ID SB2017020319
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 20% Low 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) NULL pointer dereference (CVE-ID: CVE-2016-10147)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mcryptd_check_internal() and mcryptd_create_hash() functions in crypto/mcryptd.c. A local user can perform a denial of service (DoS) attack.


2) Use-after-free (CVE-ID: CVE-2016-10150)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to a use-after-free error within the kvm_ioctl_create_device() function in virt/kvm/kvm_main.c. A remote non-authenticated attacker can execute arbitrary code.


3) Stack-based buffer overflow (CVE-ID: CVE-2016-8399)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause kernel panic or escalate privileges.

The vulnerability exists due to a boundary error when crating an ICMP header. A local user can create a very short ICMP header and execute arbitrary code within the contest of the kernel.

Successful exploitation of the vulnerability may allow a local user to escalate privileges on the system.


4) Stack-based buffer overflow (CVE-ID: CVE-2016-8632)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause kernel panic or escalate privileges.

The vulnerability exists due to a boundary error during minimum bearer MTU check within the tipc_msg_build() function. A local user can set a very short MTU, trigger stack-based buffer overflow and cause kernel panic or execute arbitrary code on the target system with elevated privileges.

Successful exploitation of the vulnerability may allow an attacker to cause kernel panic or escalate privileges on the system.


5) Out-of-bounds read (CVE-ID: CVE-2016-9777)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an out-of-bounds read error within the ioapic_read_indirect() function in arch/x86/kvm/ioapic.c. A local user can escalate privileges on the system.


Remediation

Install update from vendor's website.

References