Linux Kernel - Denial of Service Vulnerabilities
Summary
DSA-3060-1: linux - security update. Affects linux versions < 3.2.63-2+deb7u1. Fixed in 3.2.63-2+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and providing essential functionality. It is widely used in various distributions, including Debian 7 (Wheezy). This vulnerability affects the Linux kernel in Debian 7 and can lead to denial of service attacks.
Vulnerability Detail
Multiple vulnerabilities have been discovered in the Linux kernel in Debian 7. These vulnerabilities include:
- CVE-2014-3610: A flaw in KVM's handling of noncanonical writes to certain MSR registers, allowing a privileged guest user to cause a denial of service (kernel panic) on the host.
- CVE-2014-3611: A race condition in KVM's PIT emulation code, enabling a local guest user to crash the host by exploiting access to PIT I/O ports.
- CVE-2014-3645 and CVE-2014-3646: The KVM subsystem's inadequate handling of VM exits for the invept and invvpid instructions, allowing an unprivileged guest user to crash the guest on hosts with Intel processors and invept/invppid VM exit support.
- CVE-2014-3647: KVM's mishandling of noncanonical addresses when emulating instructions that change rip, potentially causing a failed VM-entry and system crash.
- CVE-2014-3673: A flaw in net/core/skbuff.c leading to a kernel panic when receiving malformed ASCONF chunks, which can be exploited remotely to crash the system.
- CVE-2014-3687: A vulnerability in the sctp stack causing a kernel panic when receiving duplicate ASCONF chunks, allowing a remote attacker to crash the system.
- CVE-2014-3688: The sctp stack's susceptibility to a remotely triggerable memory pressure issue caused by excessive queueing, enabling a remote attacker to cause denial-of-service conditions.
- CVE-2014-3690: Incorrect register handling in KVM leading to denial of service.
- CVE-2014-7207: An issue in the IPv6 networking subsystem, allowing a local user with access to tun or macvtap devices or a virtual machine connected to such a device to cause a denial of service (system crash).
How To Fix
Minimum fixed version
3.2.63-2+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
Multiple denial of service vulnerabilities have been discovered in the Linux kernel in Debian 7 (Wheezy). It is crucial to upgrade the linux package to version 3.2.63-2+deb7u1 or later to mitigate these vulnerabilities. Restarting the system after the upgrade is necessary to ensure the new kernel is loaded. If you have further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
These vulnerabilities can lead to denial of service attacks, causing system crashes and potentially disrupting the availability of affected systems.
The vulnerabilities can be exploited by privileged guest users, local guest users with access to specific I/O ports, remote attackers sending malformed ASCONF chunks, and remote attackers triggering memory pressure issues.
There are no known instances of these vulnerabilities being exploited in the wild.
No specific workarounds have been provided for these vulnerabilities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
