Linux Kernel - Multiple Vulnerabilities
Summary
DSA-3128-1: linux - security update. Affects linux versions < 3.2.65-1+deb7u1. Fixed in 3.2.65-1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system. It provides essential functionality and interfaces for various hardware devices, system processes, and user applications. The kernel is responsible for managing system resources, handling input/output operations, and enforcing security policies. However, several vulnerabilities have been discovered in the Linux kernel that could lead to denial of service attacks or information leaks.
Vulnerability Detail
This report highlights multiple vulnerabilities found in the Linux kernel:
-
CVE-2013-6885: This vulnerability affects AMD 16h 00h through 0Fh processors. Under specific circumstances, a combination of write operations to write-combined memory and locked CPU instructions may cause a core hang, leading to a denial of service.
-
CVE-2014-8133: The espfix functionality can be bypassed by installing a 16-bit RW data segment into GDT instead of LDT. This bypass allows a local unprivileged user to leak kernel stack addresses, bypassing the ASLR protection mechanism.
-
CVE-2014-9419: On Linux kernels compiled with the 32-bit interfaces, a malicious user program can perform a partial ASLR bypass through TLS base addresses leak when attacking other programs.
-
CVE-2014-9529: The Linux kernel is affected by a race condition flaw during key garbage collection, allowing local users to cause memory corruption or panic, resulting in a denial of service.
-
CVE-2014-9584: The Linux kernel does not validate a length value in the Extensions Reference (ER) System Use Field, enabling local users to obtain sensitive information from kernel memory via a crafted iso9660 image.
How To Fix
Minimum fixed version
3.2.65-1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading the Linux kernel to the recommended version will address these vulnerabilities and enhance the security of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
These vulnerabilities can lead to denial of service attacks, information leaks, and bypassing of security mechanisms such as ASLR.
Users of Linux systems running affected versions of the Linux kernel are potentially impacted.
At the time of this report, there are no known public exploits for these vulnerabilities.
These vulnerabilities require local access to the system to exploit them.
More information about each vulnerability can be found by following the provided CVE links in the vulnerability details section.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
