| Descripción: | Summary:
The remote host is missing an update for the 'linux'
package(s) announced via the referenced advisory.
Vulnerability Insight:
It was discovered that an out-of-bounds
write vulnerability existed in the Flash-Friendly File System (f2fs) in the
Linux kernel. An attacker could construct a malicious file system that, when
mounted, could cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-0750) It was discovered that a race condition leading
to a use-after-free vulnerability existed in the ALSA PCM subsystem of the Linux
kernel. A local attacker could use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2017-0861) It was discovered
that the KVM implementation in the Linux kernel allowed passthrough of the
diagnostic I/O port 0x80. An attacker in a guest VM could use this to cause a
denial of service (system crash) in the host OS. (CVE-2017-1000407) Bo Zhang
discovered that the netlink wireless configuration interface in the Linux kernel
did not properly validate attributes when handling certain requests. A local
attacker with the CAP_NET_ADMIN could use this to cause a denial of service
(system crash). (CVE-2017-12153) Vitaly Mayatskikh discovered that the SCSI
subsystem in the Linux kernel did not properly track reference counts when
merging buffers. A local attacker could use this to cause a denial of service
(memory exhaustion). (CVE-2017-12190) It was discovered that the key management
subsystem in the Linux kernel did not properly restrict key reads on negatively
instantiated keys. A local attacker could use this to cause a denial of service
(system crash). (CVE-2017-12192) It was discovered that an integer overflow
existed in the sysfs interface for the QLogic 24xx+ series SCSI driver in the
Linux kernel. A local privileged attacker could use this to cause a denial of
service (system crash). (CVE-2017-14051) Otto Ebeling discovered that the memory
manager in the Linux kernel did not properly check the effective UID in some
situations. A local attacker could use this to expose sensitive information.
(CVE-2017-14140) It was discovered that the ATI Radeon framebuffer driver in the
Linux kernel did not properly initialize a data structure returned to user
space. A local attacker could use this to expose sensitive information (kernel
memory). (CVE-2017-14156) ChunYu Wang discovered that the iSCSI transport
implementation in the Linux kernel did not properly validate data structures. A
local attacker could use this to cause a denial of service (system crash).
(CVE-2017-14489) James Patrick-Evans discovered a race condition in the LEGO USB
Infrared Tower driver in the Linux kernel. A physically proximate attacker could
use this to cause ... Description truncated, for more information please check
the Reference URL
Affected Software/OS:
linux on Ubuntu 14.04 LTS
Solution:
Please Install the Updated Packages.
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
