SB2017103122 - Ubuntu update for linux, linux-aws, linux-gke and more
Published: October 31, 2017 Updated: October 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2017-10911)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to obtain potentially sensitive information from another guest system or the host system.
The weakness exists due to improper initialization of some fields of the block interface (blkif) response structure. A local attacker can read arbitrary files from stack memory.
Successful exploitation of the vulnerability results in information disclosure.
2) NULL pointer dereference (CVE-ID: CVE-2017-12153)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
A security flaw was discovered in the nl80211_set_rekey_data() function in net/wireless/nl80211.c in the Linux kernel through 4.13.3. This function does not check whether the required attributes are present in a Netlink request. This request can be issued by a user with the CAP_NET_ADMIN capability and may result in a NULL pointer dereference and system crash.
3) Improper privilege management (CVE-ID: CVE-2017-12154)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and "CR8-store exiting" L0 vmcs02 controls exist in cases where L1 omits the "use TPR shadow" vmcs12 control, which allows KVM L2 guest OS users to obtain read and write access to the hardware CR8 register.
4) NULL pointer dereference (CVE-ID: CVE-2017-12192)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause DoS condition on the target system.
The weakness exists in the Key Management sub component of the Linux kernel when trying to issue a KEYTCL_READ on a negative key due to a NULL pointer dereference. A local attacker can cause the kernel and service to crash.
5) Integer overflow (CVE-ID: CVE-2017-14051)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause DoS condition on the target system.
The weakness exists in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.ct due to an integer overflow. A local attacker can gain root access and cause the service to crash.
6) Information disclosure (CVE-ID: CVE-2017-14156)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to obtain sensitive information on the target system.
The weakness exists in the drivers/video/fbdev/aty/atyfb_base.c due to improper initialization of a certain data structure. A local attacker can read locations associated with padding bytes and obtain sensitive information from kernel stack memory.
7) NULL pointer dereference (CVE-ID: CVE-2017-14340)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to NULL pointer dereference within the fs/xfs/xfs_linux.h. A local user can perform a denial of service (DoS) attack.
8) Denial of service (CVE-ID: CVE-2017-14489)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause DoS condition on the target system.
The weakness exists in the drivers/scsi/scsi_transport_iscsi.c due to leveraging incorrect length validation. A local attacker can cause a denial of service.
9) Memory leak (CVE-ID: CVE-2017-14991)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak in sg_ioctl() function in drivers/scsi/sg.c. A local user can obtain sensitive information from uninitialized kernel heap-memory locations via an SG_GET_REQUEST_TABLE ioctl call for /dev/sg0.
10) Information disclosure (CVE-ID: CVE-2017-15537)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to obtain potentially sensitive information.
The weakness exists in the x86/fpu (Floating Point Unit) subsystem due to incorrect handling of attempts to set reserved bits in the xstate header via the ptrace() or rt_sigreturn() system call when a processor supports the xsave feature but not the xsaves feature. A local attacker can read the FPU registers of other processes on the system, related to arch/x86/kernel/fpu/regset.c and arch/x86/kernel/fpu/signal.c.
11) Out-of-bounds read (CVE-ID: CVE-2017-9984)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to out-of-bounds read error within the snd_msnd_interrupt() function in sound/isa/msnd/msnd_pinnacle.c, within the snd_msndmidi_input_read() function in sound/isa/msnd/msnd_midi.c. A local user can execute arbitrary code.
12) Out-of-bounds read (CVE-ID: CVE-2017-9985)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to out-of-bounds read error within the snd_msnd_interrupt() function in sound/isa/msnd/msnd_pinnacle.c, within the snd_msndmidi_input_read() function in sound/isa/msnd/msnd_midi.c. A local user can execute arbitrary code.
Remediation
Install update from vendor's website.