Linux - Security Update (DLA-516-1)

Background

Linux is an open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for managing hardware resources, executing processes, and facilitating communication between software components. The Linux kernel is widely used in servers, desktops, mobile devices, and embedded systems. This security update addresses multiple vulnerabilities in the Linux kernel.

Vulnerability Detail

The security update addresses several vulnerabilities in the Linux kernel:

1. CVE-2016-0821: This vulnerability allowed a user process to manipulate kernel lists, potentially leading to privilege escalation.

2. CVE-2016-1583: The eCryptfs filesystem, when used with the proc filesystem, could cause a kernel stack overflow, enabling denial of service or privilege escalation.

3. CVE-2016-2184, CVE-2016-2185, CVE-2016-2186, CVE-2016-2187, CVE-2016-3136, CVE-2016-3137, CVE-2016-3138, CVE-2016-3140: Various USB drivers did not sufficiently validate USB descriptors, allowing a physically present user with a specially designed USB device to cause a denial of service.

4. CVE-2016-3134: The netfilter subsystem did not properly validate filter table entries, enabling denial of service or privilege escalation for users with the CAP_NET_ADMIN capability.

5. CVE-2016-3157: The x86_64 task switching implementation did not correctly update the I/O permission level when running as a Xen paravirtual guest, allowing local users to cause a denial of service or escalate privileges.

6. CVE-2016-3672: It was still possible to disable Address Space Layout Randomization (ASLR) for x86_32 programs by removing the stack resource limit, making it easier for local users to exploit security flaws.

7. CVE-2016-3951: The cdc_ncm driver prematurely freed memory during initialization, enabling a physically present user with a specially designed USB device to cause a denial of service or escalate privileges.

8. CVE-2016-3955: The usbip subsystem did not check the length of received data for a USB buffer, allowing denial of service or privilege escalation on a system configured as a usbip client.

9. CVE-2016-3961: Linux allowed the use of hugetlbfs on x86 systems running as Xen paravirtualized guests, causing a denial of service.

10. CVE-2016-4482, CVE-2016-4485, CVE-2016-4486, CVE-2016-4569, CVE-2016-4578, CVE-2016-4580, CVE-2016-5243, CVE-2016-5244: Various components leaked information from the kernel stack, potentially exposing sensitive data.

11. CVE-2016-4565: The InfiniBand stack implemented unusual semantics for the write() operation, allowing local users to cause denial of service or privilege escalation.

12. CVE-2016-4913: The ISO9660 filesystem implementation did not correctly count the length of certain invalid name entries, potentially leaking information from kernel memory.

These vulnerabilities could be exploited by local users to escalate privileges, cause denial of service, or leak sensitive information.

sudo apt-get install --only-upgrade linux

Conclusion

This security update addresses multiple vulnerabilities in the Linux kernel. It is recommended to upgrade the Linux kernel to the latest version to ensure that these vulnerabilities are patched. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for linux →

FAQ