Security Update for linux-2.6
Summary
DLA-439-1: linux-2.6 - security update. Affects linux-2.6 versions < 2.6.32-48squeeze20. Fixed in 2.6.32-48squeeze20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-2.6 package is an open-source kernel package used in the Debian 6.0 ecosystem. It provides the core functionality for the operating system, including device drivers, system calls, and process management. This package is vulnerable to multiple security issues that could lead to denial of service, privilege escalation, data loss, and memory leaks.
Vulnerability Detail
The vulnerabilities in the linux-2.6 package include:
-
CVE-2015-8812: The iw_cxgb3 Infiniband driver could result in a use-after-free vulnerability, leading to a denial of service, data loss, or privilege escalation.
-
CVE-2016-0774: The fix for CVE-2015-1805 did not handle partially failed atomic reads correctly, allowing a local unprivileged user to crash the system or leak kernel memory to user space.
-
CVE-2016-2384: A USB MIDI device with an invalid USB descriptor could trigger a double-free, potentially leading to privilege escalation.
Additionally, there are some old security issues with no CVE ID, including integer overflow vulnerabilities when reading or writing large amounts of data, which could impact certain filesystems, socket or device types. The full security impact of these issues has not been evaluated.
How To Fix
Minimum fixed version
2.6.32-48squeeze20
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linux-2.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
The linux-2.6 package in the Debian 6.0 ecosystem is vulnerable to multiple security issues. It is crucial to update to version 2.6.32-48squeeze20 to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux-2.6 →
FAQ
CVE-2015-8812 could result in a denial of service, crash, hang, data loss, or privilege escalation.
CVE-2016-2384 can be exploited by a physically present user for privilege escalation.
No specific mitigations are mentioned for the integer overflow vulnerabilities. It is recommended to update to the latest version of the linux-2.6 package.
The Debian 7.0 ecosystem is not affected by the integer overflow issues, but some remaining problems will be fixed in version 3.2.73-2+deb7u3.
You can find more information about these vulnerabilities in the Debian Security Tracker and the provided CVE links.
Related vulnerabilities
Recent vulnerabilities recorded for linux-2.6.
