You are here
Home > Preporuke > Sigurnosni nedostaci u jezgri operacijskog sustava

Sigurnosni nedostaci u jezgri operacijskog sustava

by ncert - 0
  • Detalji os-a: WN7
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LUB

==========================================================================
Ubuntu Security Notice USN-3170-1
January 11, 2017

linux vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 16.10

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux: Linux kernel

Details:

Dmitry Vyukov discovered that the KVM implementation in the Linux kernel
did not properly initialize the Code Segment (CS) in certain error cases. A
local attacker could use this to expose sensitive information (kernel
memory). (CVE-2016-9756)

Andrey Konovalov discovered that signed integer overflows existed in the
setsockopt() system call when handling the SO_SNDBUFFORCE and
SO_RCVBUFFORCE options. A local attacker with the CAP_NET_ADMIN capability
could use this to cause a denial of service (system crash or memory
corruption). (CVE-2016-9793)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
linux-image-4.8.0-34-generic 4.8.0-34.36
linux-image-4.8.0-34-generic-lpae 4.8.0-34.36
linux-image-4.8.0-34-lowlatency 4.8.0-34.36
linux-image-4.8.0-34-powerpc-e500mc 4.8.0-34.36
linux-image-4.8.0-34-powerpc-smp 4.8.0-34.36
linux-image-4.8.0-34-powerpc64-emb 4.8.0-34.36
linux-image-generic 4.8.0.34.43
linux-image-generic-lpae 4.8.0.34.43
linux-image-lowlatency 4.8.0.34.43
linux-image-powerpc-e500mc 4.8.0.34.43
linux-image-powerpc-smp 4.8.0.34.43
linux-image-powerpc64-emb 4.8.0.34.43

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
http://www.ubuntu.com/usn/usn-3170-1
CVE-2016-9756, CVE-2016-9793

Package Information:
https://launchpad.net/ubuntu/+source/linux/4.8.0-34.36

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJYdfouAAoJEC8Jno0AXoH0EbAQAJvjmmwIWS8E8PmFWfU04HOn
6Znbzk6YGTPLnDzdH/gfGBTjaIBXjgT9B4DZs0X/VFTj8+ytBrNP1+aaRgcZfx5K
rCO2QwT2wTZtk6cPEj4Ret2RzPQBj9B3HPGhKem8eTXOy4pa14zK1sn/QLtmMEu0
HkSpILjn+OTXGEtkqdMzfEIOnXySE0yv4j9SH3UtPwodDSPs+1elcfiz1JZK7kBZ
gh0UzHzGOLxNe8ExL9J8CfBtsrvQWqmY5D3Y3dt8rORvKsISpkh/iCQ4MZAhYxDh
gLIWjNEkF/1DTyVKw3LJu8GUF+DgXtOQcgT3QfBBKsb3SyCXvi2z35TkbaPNSXFZ
TAg4iY2/+1t9ZGLTQENUXXRXkErDSqjJGCvUrSeGGFvVDNdmW8dR3Sj3fq6Qx9MK
bg1XWqKf4L+0Enb49CwnudKqalUAm+RYjzYqpi3jUwE5G6gu3/08O6coapJZ9tYC
cfg4NT8zjmby2Fr3eTasrKLn22qC1E5wiHS1HsJ+qCNte6J4NvaS8/8P9AcKQ3/+
aafJ/jNry8atviHIh7EvPHDiPWPcqem0+2YRdSeF1DoLtcPWarjvBg34AHyfJp4s
CS1hbA1McVi+U5nD5scrkehAGknpizPs2VStdGDGuzm3fdw9Sh2iHLCfJ1K6jx1t
8qHneuoUqxugUVsub04g
=MSvg
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

==========================================================================
Ubuntu Security Notice USN-3169-2
January 11, 2017

linux-lts-xenial vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty

Details:

USN-3169-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.

Dmitry Vyukov discovered that the KVM implementation in the Linux kernel
did not properly initialize the Code Segment (CS) in certain error cases. A
local attacker could use this to expose sensitive information (kernel
memory). (CVE-2016-9756)

Andrey Konovalov discovered that signed integer overflows existed in the
setsockopt() system call when handling the SO_SNDBUFFORCE and
SO_RCVBUFFORCE options. A local attacker with the CAP_NET_ADMIN capability
could use this to cause a denial of service (system crash or memory
corruption). (CVE-2016-9793)

Baozeng Ding discovered a race condition that could lead to a use-after-
free in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux
kernel. A local attacker could use this to cause a denial of service
(system crash). (CVE-2016-9794)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
linux-image-4.4.0-59-generic 4.4.0-59.80~14.04.1
linux-image-4.4.0-59-generic-lpae 4.4.0-59.80~14.04.1
linux-image-4.4.0-59-lowlatency 4.4.0-59.80~14.04.1
linux-image-4.4.0-59-powerpc-e500mc 4.4.0-59.80~14.04.1
linux-image-4.4.0-59-powerpc-smp 4.4.0-59.80~14.04.1
linux-image-4.4.0-59-powerpc64-emb 4.4.0-59.80~14.04.1
linux-image-4.4.0-59-powerpc64-smp 4.4.0-59.80~14.04.1
linux-image-generic-lpae-lts-xenial 4.4.0.59.46
linux-image-generic-lts-xenial 4.4.0.59.46
linux-image-lowlatency-lts-xenial 4.4.0.59.46
linux-image-powerpc-e500mc-lts-xenial 4.4.0.59.46
linux-image-powerpc-smp-lts-xenial 4.4.0.59.46
linux-image-powerpc64-emb-lts-xenial 4.4.0.59.46
linux-image-powerpc64-smp-lts-xenial 4.4.0.59.46

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
http://www.ubuntu.com/usn/usn-3169-2
http://www.ubuntu.com/usn/usn-3169-1
CVE-2016-9756, CVE-2016-9793, CVE-2016-9794

Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-xenial/4.4.0-59.80~14.04.1

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJYdfoKAAoJEC8Jno0AXoH0u0QP/2bmK/L19dJhUFi1cEneqHGy
8iGxMGDhd0YIEtvlL0RWua5QQaE5cwMIDDtENrqH1HXxToQwx09Zht+JU855yjrc
aSOdOY/fAcpH61TdshgCCaJv8lLi3ITg9IAsCwymu4ZCPPkQhUPY/LaKquqRLctm
LMaKCw8Tzn8nTJVVPDpOD9uGWSwr7u4uXKTpBbWiYHmVVeSoshD1OxvpKO21kYdo
Y7uVNsnEXpxzz7HbML41s+d2qCuXLed4FJ4hCERj1FeDXC3+qbrcPZJIn+qxrZxQ
hByJCWQzR7W0iigk8cPCm8OoBoMKJKUzJs2OBzLCEZMnrsoGH8ZA34e1SR+gjHmi
G8C0U6CDU2zzHyfBnjuaX1XJmd5vQyv79rPEach/tnUB2oXad0WiTV1pbRFHL6kY
v+2fLgGl7pTRRqOVIqP0a0GZ+VtVlQ7Bq+Bs7Vo9JkryR6W3aRZAYs5sUDf4GZP2
B4Hu93dDgJnpwI0hRgsUAUJ54UTbroIj2fX8IlT5MH1ifES8EgJCenf+MNWVBk99
Szn/TzcVsGkgG4uBJlqY54Mq3TTlH8A7Lg+vugZwkagkoHnXqhTFs+Vuh6CYm7CU
PM+CMz55rosu6sWtDOlYif5syD0Fq9aI+t8mQe7dRwSUyA7OxBR3+S7gv3DbOdNI
kwkgDjM1Dv33nbnIlTbI
=HpDC
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

==========================================================================
Ubuntu Security Notice USN-3169-1
January 11, 2017

linux vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux: Linux kernel

Details:

Dmitry Vyukov discovered that the KVM implementation in the Linux kernel
did not properly initialize the Code Segment (CS) in certain error cases. A
local attacker could use this to expose sensitive information (kernel
memory). (CVE-2016-9756)

Andrey Konovalov discovered that signed integer overflows existed in the
setsockopt() system call when handling the SO_SNDBUFFORCE and
SO_RCVBUFFORCE options. A local attacker with the CAP_NET_ADMIN capability
could use this to cause a denial of service (system crash or memory
corruption). (CVE-2016-9793)

Baozeng Ding discovered a race condition that could lead to a use-after-
free in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux
kernel. A local attacker could use this to cause a denial of service
(system crash). (CVE-2016-9794)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
linux-image-4.4.0-59-generic 4.4.0-59.80
linux-image-4.4.0-59-generic-lpae 4.4.0-59.80
linux-image-4.4.0-59-lowlatency 4.4.0-59.80
linux-image-4.4.0-59-powerpc-e500mc 4.4.0-59.80
linux-image-4.4.0-59-powerpc-smp 4.4.0-59.80
linux-image-4.4.0-59-powerpc64-emb 4.4.0-59.80
linux-image-4.4.0-59-powerpc64-smp 4.4.0-59.80
linux-image-generic 4.4.0.59.62
linux-image-generic-lpae 4.4.0.59.62
linux-image-lowlatency 4.4.0.59.62
linux-image-powerpc-e500mc 4.4.0.59.62
linux-image-powerpc-smp 4.4.0.59.62
linux-image-powerpc64-emb 4.4.0.59.62
linux-image-powerpc64-smp 4.4.0.59.62

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
http://www.ubuntu.com/usn/usn-3169-1
CVE-2016-9756, CVE-2016-9793, CVE-2016-9794

Package Information:
https://launchpad.net/ubuntu/+source/linux/4.4.0-59.80

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJYdfn+AAoJEC8Jno0AXoH0X6sP/2HocuXeERrzlgs2cjQZR0h4
kcd3VgnQvLK87M0hQvBij1FZkCcMvGf3MiN34F+Kk9XWPSLHhbDvdQOiFIB2h+Un
bCbRNB5cVJbIG8VPpu2IlP9ZEKWdMurku9gkfvvMMfNQ657ilZrg9fF8P9z4aElN
zj7aBQgqfgXjNmpjsnVwblk6GNWzrozM6/0lM1Df+8s14DFh+M0+D2eFe0AcL65c
AHGQX7QoJXL0OT6y9cmcPO9VWBFWyQ9AnY5cBgs7s74PVemNopx3rTsqgLQhFTiR
K7HNL+HhQkgkBKMhn6YhpDzr8hXfN5AwSkfAsCzDSDtSpobme6HJNcpi/lHANk6B
BDD5krFJHhlCQMQ3X/3NqkFMWhjoXpWoaEndWLJIo1fu8FgJaHTN+btG59Tno7HW
cKl13DzBtMYR0g8FPEIAzBtCRg6gSKdLphGwCEXWmJgQwg89wecGEPDzXXkXsHmq
f4CoLlmZbToW7t6mxefOvdawc+QtV8cl1dAESo5PUDNRre9uwQWLDOkBTUQtEY34
+aP/bPq183OJNZodDyH7ppa8X9eRE1vMrHGFWq1tyMgRiFF8L2FzxeZWkcjZ1B2z
BboGrdXVGOFE6IdyJYBVqE5IEXSmL2edy52zX+kh3yNthbbJpRizArjsL5E/Og7v
FsMHu2pwCtLerLRCBPgK
=FiBK
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

==========================================================================
Ubuntu Security Notice USN-3168-2
January 11, 2017

linux-lts-trusty vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 12.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux-lts-trusty: Linux hardware enablement kernel from Trusty for Precise

Details:

USN-3168-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu
12.04 LTS.

Dmitry Vyukov discovered that the KVM implementation in the Linux kernel
did not properly initialize the Code Segment (CS) in certain error cases. A
local attacker could use this to expose sensitive information (kernel
memory). (CVE-2016-9756)

Andrey Konovalov discovered that signed integer overflows existed in the
setsockopt() system call when handling the SO_SNDBUFFORCE and
SO_RCVBUFFORCE options. A local attacker with the CAP_NET_ADMIN capability
could use this to cause a denial of service (system crash or memory
corruption). (CVE-2016-9793)

Baozeng Ding discovered a race condition that could lead to a use-after-
free in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux
kernel. A local attacker could use this to cause a denial of service
(system crash). (CVE-2016-9794)

Baozeng Ding discovered a double free in the netlink_dump() function in the
Linux kernel. A local attacker could use this to cause a denial of service
(system crash). (CVE-2016-9806)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
linux-image-3.13.0-107-generic 3.13.0-107.154~precise1
linux-image-3.13.0-107-generic-lpae 3.13.0-107.154~precise1
linux-image-generic-lpae-lts-trusty 3.13.0.107.98
linux-image-generic-lts-trusty 3.13.0.107.98

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
http://www.ubuntu.com/usn/usn-3168-2
http://www.ubuntu.com/usn/usn-3168-1
CVE-2016-9756, CVE-2016-9793, CVE-2016-9794, CVE-2016-9806

Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-trusty/3.13.0-107.154~precise1

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJYdfnxAAoJEC8Jno0AXoH0PdMP/3WsjLgpcFgkMxjapqQ/YxZ7
33a/80djQOsBGEu5IEDWktB7B7+by40/+9W7qcWoJILgpqjHKsFXQLZPqHqgsmH8
h5qx7u4KoqbhoxFssDvun2BedQ+i3+zyf63dvdbhm0qnvyqqj9HWzpFC9AIsJBRE
7vfLplfbTZY6uyg/yONcwwYpSdNB2WOL4pxxSqbiPu8YvbxFAzHcQGjgg9n1V4O4
hsYKL1iMhEsNF/IxjSunkIlovjWUqIoQb4s3ajtmxdTtfEM4nrLuLgX8Vfn/UphU
+63TR2mtwpH1mQHGuM22QtHBalfN7uBNIhsYA26lxd+OJlfVXJGOTZts3k4LadPS
RX/2p7KylnxGcjlsSqfEaZwH3TM+rEFSJI46NmbabuyRyOiG1fl1fkekYS/5e44U
eUqaMBTfwQ4uMSxZsoNYyqayq/V47bXH2LtLcqmrco9Hz36pwvsXE1Ay0njoRoxv
A2ZV4RxTXP12JzhTDRkrgg16IJ/ylYFMisLXAHX8tRNCYzgO7RJPmVHjS6NNwxKs
YMOayvnlIDNSCdow8K7EIlNJB5C113a5ZOPHafRiGAa9DOa3NBKlajZQUEOx1qXg
Un8oMn/ol0Jv10nLy8PguTROY1FMIxvfA0kxgCDpHziZoozW4rYHKfo5EkozT2dT
H746ipyHLIsM6qjpGUEr
=aOFx
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

==========================================================================
Ubuntu Security Notice USN-3167-1
January 11, 2017

linux vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 12.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux: Linux kernel

Details:

Dmitry Vyukov discovered that the KVM implementation in the Linux
kernel did not properly initialize the Code Segment (CS) in certain
error cases. A local attacker could use this to expose sensitive
information (kernel memory).

Baozeng Ding discovered a race condition that could lead to a use-after-
free in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux
kernel. A local attacker could use this to cause a denial of service
(system crash). (CVE-2016-9794)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
linux-image-3.2.0-120-generic 3.2.0-120.163
linux-image-3.2.0-120-generic-pae 3.2.0-120.163
linux-image-3.2.0-120-highbank 3.2.0-120.163
linux-image-3.2.0-120-omap 3.2.0-120.163
linux-image-3.2.0-120-powerpc-smp 3.2.0-120.163
linux-image-3.2.0-120-powerpc64-smp 3.2.0-120.163
linux-image-3.2.0-120-virtual 3.2.0-120.163
linux-image-generic 3.2.0.120.135
linux-image-generic-pae 3.2.0.120.135
linux-image-highbank 3.2.0.120.135
linux-image-omap 3.2.0.120.135
linux-image-powerpc-smp 3.2.0.120.135
linux-image-powerpc64-smp 3.2.0.120.135
linux-image-virtual 3.2.0.120.135

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
http://www.ubuntu.com/usn/usn-3167-1
CVE-2016-9756, CVE-2016-9794

Package Information:
https://launchpad.net/ubuntu/+source/linux/3.2.0-120.163

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJYdfkVAAoJEC8Jno0AXoH0O9YQAKNYIbc6z3WFdy9w0sWlLYQS
e3OrnUN2R74jCRDh9EZZt/1KUSXQ0IaxzyPoUEdYAKaG4g2AjXuyCwmjjj3P5nu4
usoPX7XflbIFwbgkosAxG3S991LitNT3UtXdJ2upASdLSekeIM3hBLtxz5DE7H5y
ZJ4HHWnboTDg32pmbNRn5vYymfp6XCbeHdtwVycWJDIOR9I02kVYyOeMh+e791Bg
p8u2jrO0Z+rjbPO8W5ubKITPstBNS/Vbm6J454FGS84RtXkBNrQoN2qjhO+IDnLF
YMuRVr3dyl1Nz3lvVG+R1YClNmKjermWui0k7ii3V1ggRApVRoJl2btCt+YA2L9q
WbuVo4am1SNP4Bqv/b2DlY8HPF7uH90jxeoyniYrp4V0XJND8oqIEUqNPMg15GqG
TjS+54vzIvWzr91EpiDx/QKW2jGcJTZeCkNhYPs6xqtIKFHmUVeA7yG2arJGxfc9
4AVC1jvy00dykdBo4W3OHDRP59kc10n/A/6hJw58qTbhDK3I3gUwkHhLmLsbUTIy
plhdVT4NTS1SoTkvi6A9KqOQ7JEcQqSwCNaLEx3lLlS7ZGaHbRAaUehjiRuPghlg
sU4fx7+wzcWSMXGOCyqXTWQI+WUgnYSu005+PldwH/ezHfhltxSdqLbeiWprEOrI
0x2+QWAG+HAYjZh2nrGN
=Dic6
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

==========================================================================
Ubuntu Security Notice USN-3168-1
January 11, 2017

linux vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux: Linux kernel

Details:

Dmitry Vyukov discovered that the KVM implementation in the Linux kernel
did not properly initialize the Code Segment (CS) in certain error cases. A
local attacker could use this to expose sensitive information (kernel
memory). (CVE-2016-9756)

Andrey Konovalov discovered that signed integer overflows existed in the
setsockopt() system call when handling the SO_SNDBUFFORCE and
SO_RCVBUFFORCE options. A local attacker with the CAP_NET_ADMIN capability
could use this to cause a denial of service (system crash or memory
corruption). (CVE-2016-9793)

Baozeng Ding discovered a race condition that could lead to a use-after-
free in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux
kernel. A local attacker could use this to cause a denial of service
(system crash). (CVE-2016-9794)

Baozeng Ding discovered a double free in the netlink_dump() function in the
Linux kernel. A local attacker could use this to cause a denial of service
(system crash). (CVE-2016-9806)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
linux-image-3.13.0-107-generic 3.13.0-107.154
linux-image-3.13.0-107-generic-lpae 3.13.0-107.154
linux-image-3.13.0-107-lowlatency 3.13.0-107.154
linux-image-3.13.0-107-powerpc-e500 3.13.0-107.154
linux-image-3.13.0-107-powerpc-e500mc 3.13.0-107.154
linux-image-3.13.0-107-powerpc-smp 3.13.0-107.154
linux-image-3.13.0-107-powerpc64-emb 3.13.0-107.154
linux-image-3.13.0-107-powerpc64-smp 3.13.0-107.154
linux-image-generic 3.13.0.107.115
linux-image-generic-lpae 3.13.0.107.115
linux-image-lowlatency 3.13.0.107.115
linux-image-powerpc-e500 3.13.0.107.115
linux-image-powerpc-e500mc 3.13.0.107.115
linux-image-powerpc-smp 3.13.0.107.115
linux-image-powerpc64-emb 3.13.0.107.115
linux-image-powerpc64-smp 3.13.0.107.115

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
http://www.ubuntu.com/usn/usn-3168-1
CVE-2016-9756, CVE-2016-9793, CVE-2016-9794, CVE-2016-9806

Package Information:
https://launchpad.net/ubuntu/+source/linux/3.13.0-107.154

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJYdfk1AAoJEC8Jno0AXoH0KkEP/RkPiQtivdMva6rQhqezGGYx
/8mIlqY+gFDy/dzLxJeQ4qWWVbtfzFpQhhB2vetLMUw7udGJ8OgAdKYM2YAF9vJi
7KbMszz0A0Xc5ZPeezn21Jq22KVC3SF9MPawu+1+L409GZ30dj0wDhBiB1qFGfXY
nNe2KyWX6sUqzxy3MABOOORPlZGX/yKfdn1iNxITaeqWkz2EXy4ZLN27iiCPRGKV
YLvokkg9fxGMjcsh4y0lZoy2VmpL5amMmbr3BQSsBJVAvd600muUnv8dDr+w4Ymw
HRAXEDxXoTdIKDR0PkeIGxRvPzlTwOkhoZvxVz3uVLXzP5NoqkA1T3f5Dzb1dS3m
J0DNeKPf3kdA1K7bmI0TwisN1DL0gTcDQBAAiRxNi01MEG9zYwIEsxclJUCWKi6C
BeQbFF0QjrzzXspkWHbbB04ZJwUpZtNPZc6p0hu7aFsHvSGKcW3NREE4i7JchI4t
EpP2FdUOr5bKmEadb2Sjck/74wJBLEyp40I0ySbzn5DDhDMjq/nkX8nV5X09VlL8
HX8Q/bLBspsD3g2oI7CM1Bix0Bq29Y1dHJpBMTABjb5JL/ZPsalFxpo3aUOGl3t5
Ynqhid29Xnw3vG7+ruYIDVAD1qmRSMkfaJRYjfjsulPMCzlagTrmfB4Hx0G+UKO+
KOdLDtk/OKiH+lqny4qu
=T4pu
—–END PGP SIGNATURE—–
—

AutorMarko Stanec
Cert idNCERT-REF-2017-01-0012-ADV
CveCERT-CVE-DUMMY
ID izvornikaCERT-ORIGID-DUMMY
ProizvodCERT-DUMMY-PRODUCT
Izvorhttp://www.adobe.com/
ncert
Top
More in Preporuke
Sigurnosni nedostaci programskog paketa OpenSSH

Otkriveni su sigurnosni nedostaci u programskom paketu OpenSSH za FreeBSD. Otkriveni nedostaci potencijalnim napadačima omogućuju stjecanje uvećanih ovlasti i izvršavanje...

Close