USN-1054-1: Linux kernel vulnerabilities

1 February 2011

linux, linux-ec2 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 10.10
  • Ubuntu 10.04 LTS

Summary

Multiple kernel vulnerablilities.

Software Description

  • linux - Linux kernel
  • linux-ec2 - Linux kernel for EC2

Details

Gleb Napatov discovered that KVM did not correctly check certain privileged operations. A local attacker with access to a guest kernel could exploit this to crash the host system, leading to a denial of service. (CVE-2010-0435)

Dan Rosenberg discovered that the Linux kernel TIPC implementation contained multiple integer signedness errors. A local attacker could exploit this to gain root privileges. (CVE-2010-3859)

Dan Rosenberg discovered that the Linux kernel X.25 implementation incorrectly parsed facilities. A remote attacker could exploit this to crash the kernel, leading to a denial of service. (CVE-2010-3873)

Dan Rosenberg discovered that the CAN protocol on 64bit systems did not correctly calculate the size of certain buffers. A local attacker could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2010-3874)

Vasiliy Kulikov discovered that kvm did not correctly clear memory. A local attacker could exploit this to read portions of the kernel stack, leading to a loss of privacy. (CVE-2010-3881)

Dan Rosenberg discovered that IPC structures were not correctly initialized on 64bit systems. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4073)

Dan Rosenberg discovered that the ivtv V4L driver did not correctly initialize certian structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4079)

Dan Rosenberg discovered that the semctl syscall did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2010-4083)

Dan Rosenberg discovered that the socket filters did not correctly initialize structure memory. A local attacker could create malicious filters to read portions of kernel stack memory, leading to a loss of privacy. (CVE-2010-4158)

Dan Rosenberg discovered that the Linux kernel L2TP implementation contained multiple integer signedness errors. A local attacker could exploit this to to crash the kernel, or possibly gain root privileges. (CVE-2010-4160)

Dan Rosenberg discovered that certain iovec operations did not calculate page counts correctly. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4162)

Dan Rosenberg discovered multiple flaws in the X.25 facilities parsing. If a system was using X.25, a remote attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4164)

Steve Chen discovered that setsockopt did not correctly check MSS values. A local attacker could make a specially crafted socket call to crash the system, leading to a denial of service. (CVE-2010-4165)

Dave Jones discovered that the mprotect system call did not correctly handle merged VMAs. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4169)

Dan Rosenberg discovered that the RDS protocol did not correctly check ioctl arguments. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4175)

Brad Spengler discovered that the kernel did not correctly account for userspace memory allocations during exec() calls. A local attacker could exploit this to consume all system memory, leading to a denial of service. (CVE-2010-4243)

Vegard Nossum discovered that memory garbage collection was not handled correctly for active sockets. A local attacker could exploit this to allocate all available kernel memory, leading to a denial of service. (CVE-2010-4249)

It was discovered that named pipes did not correctly handle certain fcntl calls. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-4256)

Nelson Elhage discovered that the kernel did not correctly handle process cleanup after triggering a recoverable kernel bug. If a local attacker were able to trigger certain kinds of kernel bugs, they could create a specially crafted process to gain root privileges. (CVE-2010-4258)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 10.10
linux-image-2.6.35-25-generic - 2.6.35-25.44
linux-image-2.6.35-25-generic-pae - 2.6.35-25.44
linux-image-2.6.35-25-omap - 2.6.35-25.44
linux-image-2.6.35-25-powerpc - 2.6.35-25.44
linux-image-2.6.35-25-powerpc-smp - 2.6.35-25.44
linux-image-2.6.35-25-powerpc64-smp - 2.6.35-25.44
linux-image-2.6.35-25-server - 2.6.35-25.44
linux-image-2.6.35-25-versatile - 2.6.35-25.44
linux-image-2.6.35-25-virtual - 2.6.35-25.44
Ubuntu 10.04 LTS
linux-image-2.6.32-28-386 - 2.6.32-28.55
linux-image-2.6.32-28-generic - 2.6.32-28.55
linux-image-2.6.32-28-generic-pae - 2.6.32-28.55
linux-image-2.6.32-28-ia64 - 2.6.32-28.55
linux-image-2.6.32-28-lpia - 2.6.32-28.55
linux-image-2.6.32-28-powerpc - 2.6.32-28.55
linux-image-2.6.32-28-powerpc-smp - 2.6.32-28.55
linux-image-2.6.32-28-powerpc64-smp - 2.6.32-28.55
linux-image-2.6.32-28-preempt - 2.6.32-28.55
linux-image-2.6.32-28-server - 2.6.32-28.55
linux-image-2.6.32-28-sparc64 - 2.6.32-28.55
linux-image-2.6.32-28-sparc64-smp - 2.6.32-28.55
linux-image-2.6.32-28-versatile - 2.6.32-28.55
linux-image-2.6.32-28-virtual - 2.6.32-28.55
linux-image-2.6.32-312-ec2 - 2.6.32-312.24

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. If you use linux-restricted-modules, you have to update that package as well to get modules which work with the new kernel version. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-server, linux-powerpc), a standard system upgrade will automatically perform this as well.

References