USN-1394-1: linux-ti-omap4 vulnerabilities

7 March 2012

Linux kernel (OMAP4) vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 10.10

Summary

Several security issues were fixed in the kernel.

Software Description

  • linux-ti-omap4 - Linux kernel for OMAP4

Details

Aristide Fattori and Roberto Paleari reported a flaw in the Linux kernel’s handling of IPv4 icmp packets. A remote user could exploit this to cause a denial of service. (CVE-2011-1927)

Vegard Nossum discovered a leak in the kernel’s inotify_init() system call. A local, unprivileged user could exploit this to cause a denial of service. (CVE-2010-4250)

An error was discovered in the kernel’s handling of CUSE (Character device in Userspace). A local attacker might exploit this flaw to escalate privilege, if access to /dev/cuse has been modified to allow non-root users. (CVE-2010-4650)

A flaw was found in the kernel’s Integrity Measurement Architecture (IMA). Changes made by an attacker might not be discovered by IMA, if SELinux was disabled, and a new IMA rule was loaded. (CVE-2011-0006)

A flaw was found in the Linux Ethernet bridge’s handling of IGMP (Internet Group Management Protocol) packets. An unprivileged local user could exploit this flaw to crash the system. (CVE-2011-0716)

Dan Rosenberg reported errors in the OSS (Open Sound System) MIDI interface. A local attacker on non-x86 systems might be able to cause a denial of service. (CVE-2011-1476)

Dan Rosenberg reported errors in the kernel’s OSS (Open Sound System) driver for Yamaha FM synthesizer chips. A local user can exploit this to cause memory corruption, causing a denial of service or privilege escalation. (CVE-2011-1477)

Dan Rosenberg reported an error in the old ABI compatibility layer of ARM kernels. A local attacker could exploit this flaw to cause a denial of service or gain root privileges. (CVE-2011-1759)

Ben Hutchings reported a flaw in the kernel’s handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges. (CVE-2011-2182)

A flaw was discovered in the Linux kernel’s AppArmor security interface when invalid information was written to it. An unprivileged local user could use this to cause a denial of service on the system. (CVE-2011-3619)

It was discovered that some import kernel threads can be blocked by a user level process. An unprivileged local user could exploit this flaw to cause a denial of service. (CVE-2011-4621)

A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. (CVE-2012-0038)

Chen Haogang discovered an integer overflow that could result in memory corruption. A local unprivileged user could use this to crash the system. (CVE-2012-0044)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 10.10
linux-image-2.6.35-903-omap4 - 2.6.35-903.32

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make all the necessary changes.

References