Linux Kernel - Denial of Service Vulnerabilities
Summary
DSA-3396-1: linux - security update. Affects linux versions < 3.2.68-1+deb7u6. Fixed in 3.2.68-1+deb7u6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and providing essential functionality. It is widely used in various distributions, including Debian. The kernel interacts with hardware devices, manages processes, and implements security measures. However, several vulnerabilities have been discovered in the Linux kernel that can lead to denial of service attacks.
Vulnerability Detail
The Linux kernel is affected by multiple vulnerabilities:
-
CVE-2015-5307: A guest to host denial of service flaw in the KVM hypervisor allows a malicious guest to trigger an infinite stream of alignment check exceptions, causing the processor microcode to enter an infinite loop. This results in a panic of the host kernel.
-
CVE-2015-7833: The usbvision driver improperly processes certain USB device descriptors, allowing an attacker with physical access to crash the system.
-
CVE-2015-7872: The keyrings garbage collector has a vulnerability that can be exploited by a local user to trigger a kernel panic.
-
CVE-2015-7990: The fix for CVE-2015-6937 is incomplete, allowing a race condition when sending a message on an unbound socket, leading to a NULL pointer dereference and a potential denial of service.
These vulnerabilities can be exploited by attackers to disrupt the normal operation of affected systems, potentially leading to system crashes and unavailability.
How To Fix
Minimum fixed version
3.2.68-1+deb7u6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Multiple denial of service vulnerabilities have been discovered in the Linux kernel. It is crucial to update the Linux kernel packages to the recommended versions to mitigate the risk of exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and providing essential functionality.
A denial of service vulnerability allows an attacker to disrupt the normal operation of a system, potentially leading to system crashes and unavailability.
A malicious guest can trigger an infinite stream of alignment check exceptions, causing the processor microcode to enter an infinite loop and leading to a panic of the host kernel.
An attacker with physical access to the system can crash the system by exploiting the usbvision driver's improper processing of certain USB device descriptors.
A local user can trigger a kernel panic by exploiting the vulnerability in the keyrings garbage collector.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
