Linux Security Update - Vulnerability in linux package
Summary
DLA-609-1: linux - security update. Affects linux versions < 3.2.81-2. Fixed in 3.2.81-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The linux package is a widely used open-source operating system kernel that provides the core functionality for various Linux distributions. It is responsible for managing system resources, providing device drivers, and enabling communication between hardware and software components. The linux package is utilized by Debian 7 (Wheezy) and Debian 8 (Jessie) distributions.
Vulnerability Detail
The linux package is affected by multiple vulnerabilities:
- CVE-2016-3857: Two bugs in the ARM OABI compatibility layer can be exploited by local users for privilege escalation.
- CVE-2016-4470: In certain error cases, the KEYS subsystem may dereference an uninitialized pointer, leading to denial of service or potential privilege escalation.
- CVE-2016-5696: Linux's implementation of the TCP Challenge ACK feature allows remote attackers to find TCP connections between specific IP addresses and inject messages into those connections, potentially leading to impersonation or denial of service.
- CVE-2016-5829: Multiple heap-based buffer overflow vulnerabilities in the hiddev driver can be exploited by local users with access to a HID device, resulting in denial of service or potential privilege escalation.
- CVE-2016-6136: The audit subsystem has a 'double-fetch' or TOCTTOU bug in its handling of special characters in the name of an executable, allowing local users to generate misleading log messages when audit logging of execve() is enabled.
- CVE-2016-6480: The aacraid driver for Adaptec RAID controllers has a 'double-fetch' or TOCTTOU bug in its validation of FIB messages passed through the ioctl() system call, but it has no practical security impact in current Debian releases.
- CVE-2016-6828: A 'use-after-free' bug in the TCP implementation can be triggered by local users, potentially leading to denial of service or privilege escalation.
- CVE-2016-7118: Calling fcntl() on a file descriptor for a directory on an aufs filesystem can cause an oops, resulting in denial of service. This is a Debian-specific regression introduced in version 3.2.81-1.
How To Fix
Minimum fixed version
3.2.81-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
The linux package is affected by multiple vulnerabilities that can result in privilege escalation, denial of service, impersonation, and other security issues. It is crucial to upgrade to the recommended versions to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The impact of these vulnerabilities varies, ranging from privilege escalation and denial of service to potential impersonation and misleading log messages.
Short-lived TCP connections are unlikely to be vulnerable due to the time required for an attack.
Increasing the rate limit for TCP Challenge ACKs can mitigate this vulnerability. The following command can be used:
sysctl net.ipv4.tcp_challenge_ack_limit=1000000000
No, the aacraid driver vulnerability has no practical security impact in current Debian releases.
The security impact of the 'use-after-free' bug is unclear, but it may include denial of service or privilege escalation.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
