You are here
Home > Preporuke > Sigurnosni nedostaci u jezgri operacijskog sustava

Sigurnosni nedostaci u jezgri operacijskog sustava

  • Detalji os-a: WN7
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LUB

==========================================================================
Kernel Live Patch Security Notice LSN-0014-1
December 07, 2016

linux vulnerability
==========================================================================

A security issue affects these releases of Ubuntu:

| Series | Base kernel | Arch | flavors |
|——————+————–+———-+——————|
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | generic |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | lowlatency |

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux: Linux kernel

Details:

Philip Pettersson discovered a race condition in the af_packet
implementation in the Linux kernel. A local unprivileged attacker could use
this to cause a denial of service (system crash) or run arbitrary code with
administrative privileges. (CVE-2016-8655)

Pengfei Wang discovered a race condition in the Adaptec AAC RAID controller
driver in the Linux kernel when handling ioctl()s. A local attacker could
use this to cause a denial of service (system crash). (CVE-2016-6480)

Marco Grassi discovered a use-after-free condition could occur in the TCP
retransmit queue handling code in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2016-6828)

Update instructions:

The problem can be corrected by updating your livepatches to the following
versions:

| Kernel | Version | flavors |
|—————–+———-+————————–|
| 4.4.0-21.37 | 15.1 | generic, lowlatency |
| 4.4.0-22.39 | 15.1 | generic, lowlatency |
| 4.4.0-22.40 | 15.1 | generic, lowlatency |
| 4.4.0-24.43 | 15.1 | generic, lowlatency |
| 4.4.0-28.47 | 15.1 | generic, lowlatency |
| 4.4.0-31.50 | 15.1 | generic, lowlatency |
| 4.4.0-34.53 | 15.1 | generic, lowlatency |
| 4.4.0-36.55 | 15.1 | generic, lowlatency |
| 4.4.0-38.57 | 15.1 | generic, lowlatency |
| 4.4.0-42.62 | 15.1 | generic, lowlatency |
| 4.4.0-43.63 | 15.1 | generic, lowlatency |
| 4.4.0-45.66 | 15.1 | generic, lowlatency |
| 4.4.0-47.68 | 15.1 | generic, lowlatency |
| 4.4.0-51.72 | 15.1 | generic, lowlatency |

Additionally, you should install an updated kernel with these fixes and
reboot at your convienience.

References:
CVE-2016-6480, CVE-2016-6828, CVE-2016-8655
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBAgAGBQJYR/BeAAoJENt0rrj9ziT8Wc4P/328Se//ZjipxlgoCRv13SzX
ZHBm9++JAAiLdvdpkCYgjl2IRmdKRoW8h9NpTwRm7VaDDC7KMbT1V842D4CVA04B
XXKLwDB1e4gPPIKx3j0lcxHunbFO8546yzmGjqt9ULDTHIiaUk4dgjbGsSOoEqYn
WlMMMmE3MpQuhjX8u8bhDnZz3K9HMfPHX2WdiKrxU6dJc8N2HMhksotmsPjcCmL5
do/W56QaAIB+4xMHyyY7IAZEsgR+CBCFe7Q05E2fqXfaj5ow3LfVWqgtol22q/db
BPi22p8QT0BYarFODc3DInAeK7hj/sWIuhzvj8OcFK/GGXDGsPJIEpMWV6n9dSuM
jQjI5+bUHk68cHRf9+ctc2Agj59n7QOZK7sRNpdUcBCIzfAcf3nmiRDr+Z6Aqhdw
oKhrRLxwRqIbG1PoUghxnELysqDM77UDFWYVmSKqaRlIAavwQ8dt6wEjFlM0MTo2
MKA0UGmgf0gcOSiIlefwTpXGz2OT08bdBkwi1ssWk6y1kIXyog6fRhfXzYBDUGCu
W+AXrmqT7SB6c8Ch4IQ/3M96k8OxY0clQ58jrpQMgLp686k0i+Q9pd7rylP/7k7o
CbN1N05DXmS2PG4Okr86p3Yl9Fq17x4fvT0wgEx5SR9dFi9gSmL3mGbLS7kDr3T4
5q7hjIaATyRzOHO/Ctce
=yrDZ
—–END PGP SIGNATURE—–

AutorMarko Stanec
Cert idNCERT-REF-2016-12-0050-ADV
CveCERT-CVE-DUMMY
ID izvornikaCERT-ORIGID-DUMMY
ProizvodCERT-DUMMY-PRODUCT
Izvorhttp://www.adobe.com/
Top
More in Preporuke
Sigurnosni nedostatak programskog paketa openstack-cinder i openstack-glance

Otkriven je sigurnosni nedostatak u programskom paketu openstack-cinder i openstack-glance za Red Hat. Otkriveni nedostatak potencijalni napadači mogu ih iskoristiti...

Close