Univention Bugzilla – Bug 41693
linux: Multiple security issues (3.3)
Last modified: 2016-10-27 18:21:56 CEST
Upstream Debian (Jessie) package version 3.16.7-ckt25-2+deb8u2 fixes the following issues: CVE ID : CVE-2015-7515 CVE-2016-0821 CVE-2016-1237 CVE-2016-1583 CVE-2016-2117 CVE-2016-2143 CVE-2016-2184 CVE-2016-2185 CVE-2016-2186 CVE-2016-2187 CVE-2016-3070 CVE-2016-3134 CVE-2016-3136 CVE-2016-3137 CVE-2016-3138 CVE-2016-3140 CVE-2016-3156 CVE-2016-3157 CVE-2016-3672 CVE-2016-3951 CVE-2016-3955 CVE-2016-3961 CVE-2016-4470 CVE-2016-4482 CVE-2016-4485 CVE-2016-4486 CVE-2016-4565 CVE-2016-4569 CVE-2016-4578 CVE-2016-4580 CVE-2016-4581 CVE-2016-4805 CVE-2016-4913 CVE-2016-4997 CVE-2016-4998 CVE-2016-5243 CVE-2016-5244 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2015-7515, CVE-2016-2184, CVE-2016-2185, CVE-2016-2186, CVE-2016-2187, CVE-2016-3136, CVE-2016-3137, CVE-2016-3138, CVE-2016-3140 Ralf Spenneberg of OpenSource Security reported that various USB drivers do not sufficiently validate USB descriptors. This allowed a physically present user with a specially designed USB device to cause a denial of service (crash). CVE-2016-0821 Solar Designer noted that the list 'poisoning' feature, intended to mitigate the effects of bugs in list manipulation in the kernel, used poison values within the range of virtual addresses that can be allocated by user processes. CVE-2016-1237 David Sinquin discovered that nfsd does not check permissions when setting ACLs, allowing users to grant themselves permissions to a file by setting the ACL. CVE-2016-1583 Jann Horn of Google Project Zero reported that the eCryptfs filesystem could be used together with the proc filesystem to cause a kernel stack overflow. If the ecryptfs-utils package is installed, local users could exploit this, via the mount.ecryptfs_private program, for denial of service (crash) or possibly for privilege escalation. CVE-2016-2117 Justin Yackoski of Cryptonite discovered that the Atheros L2 ethernet driver incorrectly enables scatter/gather I/O. A remote attacker could take advantage of this flaw to obtain potentially sensitive information from kernel memory. CVE-2016-2143 Marcin Koscielnicki discovered that the fork implementation in the Linux kernel on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash). CVE-2016-3070 Jan Stancek of Red Hat discovered a local denial of service vulnerability in AIO handling. CVE-2016-3134 The Google Project Zero team found that the netfilter subsystem does not sufficiently validate filter table entries. A user with the CAP_NET_ADMIN capability could use this for denial of service (crash) or possibly for privilege escalation. Debian disables unprivileged user namespaces by default, if locally enabled with the kernel.unprivileged_userns_clone sysctl, this allows privilege escalation. CVE-2016-3156 Solar Designer discovered that the IPv4 implementation in the Linux kernel did not perform the destruction of inet device objects properly. An attacker in a guest OS could use this to cause a denial of service (networking outage) in the host OS. CVE-2016-3157 / XSA-171 Andy Lutomirski discovered that the x86_64 (amd64) task switching implementation did not correctly update the I/O permission level when running as a Xen paravirtual (PV) guest. In some configurations this would allow local users to cause a denial of service (crash) or to escalate their privileges within the guest. CVE-2016-3672 Hector Marco and Ismael Ripoll noted that it was possible to disable Address Space Layout Randomisation (ASLR) for x86_32 (i386) programs by removing the stack resource limit. This made it easier for local users to exploit security flaws in programs that have the setuid or setgid flag set. CVE-2016-3951 It was discovered that the cdc_ncm driver would free memory prematurely if certain errors occurred during its initialisation. This allowed a physically present user with a specially designed USB device to cause a denial of service (crash) or possibly to escalate their privileges. CVE-2016-3955 Ignat Korchagin reported that the usbip subsystem did not check the length of data received for a USB buffer. This allowed denial of service (crash) or privilege escalation on a system configured as a usbip client, by the usbip server or by an attacker able to impersonate it over the network. A system configured as a usbip server might be similarly vulnerable to physically present users. CVE-2016-3961 / XSA-174 Vitaly Kuznetsov of Red Hat discovered that Linux allowed the use of hugetlbfs on x86 (i386 and amd64) systems even when running as a Xen paravirtualised (PV) guest, although Xen does not support huge pages. This allowed users with access to /dev/hugepages to cause a denial of service (crash) in the guest. CVE-2016-4470 David Howells of Red Hat discovered that a local user can trigger a flaw in the Linux kernel's handling of key lookups in the keychain subsystem, leading to a denial of service (crash) or possibly to privilege escalation. CVE-2016-4482, CVE-2016-4485, CVE-2016-4486, CVE-2016-4569, CVE-2016-4578, CVE-2016-4580, CVE-2016-5243, CVE-2016-5244 Kangjie Lu reported that the USB devio, llc, rtnetlink, ALSA timer, x25, tipc, and rds facilities leaked information from the kernel stack. CVE-2016-4565 Jann Horn of Google Project Zero reported that various components in the InfiniBand stack implemented unusual semantics for the write() operation. On a system with InfiniBand drivers loaded, local users could use this for denial of service or privilege escalation. CVE-2016-4581 Tycho Andersen discovered that in some situations the Linux kernel did not handle propagated mounts correctly. A local user can take advantage of this flaw to cause a denial of service (system crash). CVE-2016-4805 Baozeng Ding discovered a use-after-free in the generic PPP layer in the Linux kernel. A local user can take advantage of this flaw to cause a denial of service (system crash), or potentially escalate their privileges. CVE-2016-4913 Al Viro found that the ISO9660 filesystem implementation did not correctly count the length of certain invalid name entries. Reading a directory containing such name entries would leak information from kernel memory. Users permitted to mount disks or disk images could use this to obtain sensitive information. CVE-2016-4997 / CVE-2016-4998 Jesse Hertz and Tim Newsham discovered that missing input sanitising in Netfilter socket handling may result in denial of service. Debian disables unprivileged user namespaces by default, if locally enabled with the kernel.unprivileged_userns_clone sysctl, this also allows privilege escalation.
More CVEs deb8u3: <https://anonscm.debian.org/cgit/kernel/linux.git/log/?h=wheezy-backports> * ALSA: compress: fix an integer overflow check (CVE-2014-9904) * [amd64] misc: mic: Fix for double fetch security bug in VOP driver (CVE-2016-5728) * [powerpc*] tm: Always reclaim in start_thread() for exec() class syscalls (CVE-2016-5828) * HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands (CVE-2016-5829) * [s390*] sclp_ctl: fix potential information leak with /dev/sclp (CVE-2016-6130) repo_admin.py -U -p linux -d wheezy-backports -r 3.3 -s errata3.3-0 # linux 3.16.7-ckt25-2+deb8u3~bpo70+1 repo_admin.py -e -r 3.3 -s errata3.3-0 -p linux /var/build/temp/linux # r16617 | linux-3.16.7-ckt25-2+deb8u3~bpo70+1 Package: linux Version: 3.16.7-ckt25-2+deb8u3~bpo70+1~ucs3.3.197.201607211442 Branch: ucs_3.3-0 Scope: errata3.3-0
r71174 | Bug #41693 kernel: Update to 3.16.7-ckt25-2+deb8u3~bpo70+1 Package: univention-kernel-image Version: 7.100.0-7.104.201607211815 Branch: ucs_3.3-0 Scope: errata3.3-0 r71177 | Bug #41693 kernel: Update to 3.16.7-ckt25-2+deb8u3~bpo70+1 YANK linux.yaml univention-kernel-image.yaml QA: uname -a # 3.16.0-ucs197-686-pae QA: uname -a # 3.16.0-ucs197-amd64
I guess we should pick up the forthcoming yet unreleased tcp-make-challenge-acks-less-predictable.patch from https://anonscm.debian.org/cgit/kernel/linux.git/commit/?h=jessie-security&id=1bd5c3370523e5846019361b33a97c754db76f8d . While it may not be that critical, and there is a workaround via sysctl.conf, it enjoys a certain publicity currently and customers will inquire.
New issues, currently only fixed in Debian sid (currently at Kernel 4.7): * Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a "double fetch" vulnerability. (CVE-2016-6136) * Race condition in the ioctl_send_fib function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value, aka a "double fetch" vulnerability. (CVE-2016-6480) * Linux tcp_xmit_retransmit_queue use after free (CVE-2016-6828)
(In reply to Arvid Requate from comment #3) > I guess we should pick up the forthcoming yet unreleased > tcp-make-challenge-acks-less-predictable.patch from > https://anonscm.debian.org/cgit/kernel/linux.git/commit/?h=jessie- > security&id=1bd5c3370523e5846019361b33a97c754db76f8d . While it may not be > that critical, and there is a workaround via sysctl.conf, it enjoys a > certain publicity currently and customers will inquire. This is CVE-2016-5696 CP 1bd5c3370523e5846019361b33a97c754db76f8d from 3.16 (In reply to Arvid Requate from comment #4) > * Race condition in the audit_log_single_execve_arg function in > kernel/auditsc.c in the Linux kernel through 4.7 allows local users to > bypass intended character-set restrictions or disrupt system-call auditing > by changing a certain string, aka a "double fetch" vulnerability. > (CVE-2016-6136) CP e06f0a239348a6a8b357554c0dc4720df11638b2 from 3.16 > * Race condition in the ioctl_send_fib function in > drivers/scsi/aacraid/commctrl.c in the Linux kernel through 4.7 allows local > users to cause a denial of service (out-of-bounds access or system crash) by > changing a certain size value, aka a "double fetch" vulnerability. > (CVE-2016-6480) CP b713215e8e54aa8852ae307bf4a07bbb2db66bf0 from 3.16 > * Linux tcp_xmit_retransmit_queue use after free (CVE-2016-6828) CP 121b60af11646210937eba34dfadb30f04f96fb5 from 3.16 CVE-2016-7118; regression in 3.16.36-1. not needed: 5a092f0ef9f759d382d11770a980b34e375a71b1 from 3.16 r16684 | Bug #41693: linux-3.16.x for UCS-3.3 Package: linux Version: 3.16.7-ckt25-2~bpo70+1~ucs3.3.199.201609051157 Branch: ucs_3.3-0 Scope: errata3.3-0 r72256 | Bug #41693, Bug #42099: More 3.16.7-ckt25-2+deb8u3~bpo70+1 Package: univention-kernel-image Version: 7.100.0-8.105.201609051515 Branch: ucs_3.3-0 Scope: errata3.3-0 r72306 | Bug #41693, Bug #42099: More 3.16.7-ckt25-2+deb8u3~bpo70+1 YAML linux.yaml univention-kernel-image.yaml
Just a question: Jessie security updated to 3.16.36-1+deb8u1, what is our strategy, is it easier to update to or to continue backporting in the future?
(In reply to Arvid Requate from comment #6) > Just a question: Jessie security updated to 3.16.36-1+deb8u1, what is our > strategy, is it easier to update to or to continue backporting in the future? The "Jessie" linux package does not compile on wheezy; see first entry of <http://metadata.ftp-master.debian.org/changelogs//main/l/linux/linux_3.16.7-ckt25-2+deb8u3~bpo70+1_changelog> You either have to make the Jessie kernel compile on Wheezy (or even Squeeze which UCS-3 is based on), or need to pick the patches yourself from Jessie missing in Wheezy-Backport. I've choose to lessen my pain by cherry-picking the missing patches.
Ok, the patches are part of the linux source package 3.16.38 packaged for Bug 42353: The patch for CVE-2016-5696: jessie-security git commit 1bd5c3370523e5846019361b33a97c754db76f8d linux-stable git commit c6287499662db0b0caee72d6453e445a2c6162af part of branch linux-3.16.y The patch for CVE-2016-6136: jessie-security git commit e06f0a239348a6a8b357554c0dc4720df11638b2 linux-stable git commit c8a3667e957a498865ec82c3d19160f1a330daef part of branch linux-3.16.y The patch for CVE-2016-6480: jessie-security git commit b713215e8e54aa8852ae307bf4a07bbb2db66bf0 now part of 3.16.38-0.1+deb8u2~bpo70+1-errata3.3-0 applied as debian/patches: bugfix/all/aacraid-Check-size-values-after-double-fetch-from-us.patch The patch for CVE-2016-6828: jessie-security git commit 121b60af11646210937eba34dfadb30f04f96fb5 now part of 3.16.38-0.1+deb8u2~bpo70+1-errata3.3-0 applied as debian/patches: bugfix/all/tcp-fix-use-after-free-in-tcp_xmit_retransmit_queue.patch
<http://errata.software-univention.de/ucs/3.3/18.html> <http://errata.software-univention.de/ucs/3.3/19.html>
*** Bug 42353 has been marked as a duplicate of this bug. ***