SB2016102710 - Multiple vulnerabilities in Linux Kernel

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016102710

SB2016102710 - Multiple vulnerabilities in Linux Kernel

Published: October 27, 2016 Updated: May 23, 2018

Security Bulletin ID SB2016102710
Severity
Low
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 secuirty vulnerabilities.


1) Missing authorization (CVE-ID: CVE-2016-10318)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the fscrypt_process_policy function in fs/crypto/policy.c in the ext4 and f2fs filesystem encryption support due to missing authorization check. A remote attacker can assign an encryption policy to a directory owned by a different user and cause the service to crash.

2) Integer overflow (CVE-ID: CVE-2016-0758)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in lib/asn1_decoder.c due to integer overflow. A local attacker can submit specially crafted ASN.1 data and gain root privileges.

3) Privilege escalation (CVE-ID: CVE-2016-7097)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to the setgid bit being preserved during a setxattr call by the filesystem implementation. A local attacker can leverage the existence of a setgid program to gain group privileges.

Successful exploitation of the vulnerability results in privileges escalation.

4) Denial of service (CVE-ID: CVE-2016-7042)

The vulnerability allows a local user to cause DoS conditions on the target system.
The weakness exists due to using of incorrect buffer size for certain timeout data by the proc_keys_show function in security/keys/proc.c while enabling of GNU Compiler Collection (gcc) stack protector. By reading the /proc/keys file attackers can trigger stack memory corruption.
Successful exploitation of the vulnerability may result in denial of service on the vulnerable system.

5) Resource exhaustion (CVE-ID: CVE-2016-7039)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the IP stack due to stack consumption. A remote attacker can trigger use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, and cause the service to crash.

6) NULL pointer dereference (CVE-ID: CVE-2016-8630)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the x86_decode_insn function in arch/x86/kvm/emulate.c due to NULL pointer dereference when KVM is enabled. A local attacker can cause the service to crash via a certain use of a ModR/M byte in an undefined instruction.

7) Privilege escalation (CVE-ID: CVE-2016-4565)

The vulnerability allows a local attacker to cause DoS condition or gain elevated privileges on the target system.

The weakness exists due to it incorrectly relies on the write system call. A local attacker can cause the service to crash or gain root privileges.

8) Null pointer dereference (CVE-ID: CVE-2015-8970)

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists due to crypto/algif_skcipher.c in the Linux kernel does not verify that a setkey operation has been performed on an AF_ALG socket before an accept system call is processed. A local attacker can provide a specially crafted application that does not supply a key, related to the lrw_crypt function in crypto/lrw.c., trigger NULL pointer dereference and cause the system to crash.

Successful exploitation of the vulnerability results in denial of service.

Remediation

Install update from vendor's website.

References