USN-2970-1 Linux kernel (Vivid HWE) vulnerabilities


Severity

Medium

Vendor

Canonical Ubuntu

Versions Affected
  • Canonical Ubuntu 14.04 LTS
Description

Ralf Spenneberg discovered that the Aiptek Tablet USB device driver in the Linux kernel did not properly sanity check the endpoints reported by the device. An attacker with physical access could cause a denial of service (system crash). (CVE-2015-7515)

Ben Hawkes discovered that the Linux kernel's AIO interface allowed single writes greater than 2GB, which could cause an integer overflow when writing to certain filesystems, socket or device types. A local attacker could this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2015-8830)

Zach Riggle discovered that the Linux kernel's list poison feature did not take into account the mmap_min_addr value. A local attacker could use this to bypass the kernel's poison-pointer protection mechanism while attempting to exploit an existing kernel vulnerability. (CVE-2016-0821)

Ralf Spenneberg discovered that the USB sound subsystem in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-2184)

Ralf Spenneberg discovered that the ATI Wonder Remote II USB driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-2185)

Ralf Spenneberg discovered that the PowerMate USB driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-2186)

Ralf Spenneberg discovered that the I/O-Warrior USB device driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-2188)

Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the MCT USB RS232 Converter device driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-3136)

Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Cypress M8 USB device driver in the Linux kernel did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-3137)

Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the USB abstract device control driver for modems and ISDN adapters did not validate endpoint descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-3138)

Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the Linux kernel's USB driver for Digi AccelePort serial converters did not properly validate USB device descriptors. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-3140)

It was discovered that the IPv4 implementation in the Linux kernel did not perform the destruction of inet device objects properly. An attacker in a guest OS could use this to cause a denial of service (networking outage) in the host OS. (CVE-2016-3156)

Andy Lutomirski discovered that the Linux kernel did not properly context-switch IOPL on 64-bit PV Xen guests. An attacker in a guest OS could use this to cause a denial of service (guest OS crash), gain privileges, or obtain sensitive information. (CVE-2016-3157)

It was discovered that the Linux kernel's USB driver for IMS Passenger Control Unit devices did not properly validate the device's interfaces. An attacker with physical access could use this to cause a denial of service (system crash). (CVE-2016-3689)

Affected Pivotal Products and Versions

Severity is medium unless otherwise noted.

  • Cloud Foundry BOSH stemcells 3146.x versions prior to 3146.12 AND other versions prior to 3232.3 are vulnerable
  • Pivotal Cloud Foundry Ops Manager versions prior to 1.6.13 AND 1.7.x versions prior to 1.7.3
  • Pivotal Cloud Foundry Elastic Runtime versions prior to 1.6.24 AND 1.7.x versions prior to 1.7.2
  • MySQL for Pivotal Cloud Foundry versions prior to 1.6.11, versions 1.7.x prior to 1.7.8 AND 1.8.x prior to 1.8.0-edge.6
  • RabbitMQ for Pivotal Cloud Foundry versions prior to 1.5.10
  • Redis for Pivotal Cloud Foundry versions prior to 1.4.24 AND 1.5.x versions prior to 1.5.13
  • RiakCS for Pivotal Cloud Foundry versions prior to 1.5.12
  • Pivotal Cloud Foundry Single Sign-on versions prior to 1.0.12
Mitigation

Users of affected versions should apply the following mitigation:

  • The Cloud Foundry project recommends that Cloud Foundry upgrade BOSH stemcell 3146.x versions to 3146.12 OR other versions to 3232.4
  • Pivotal Cloud Foundry Ops Manager versions prior to 1.6.13 should be upgraded to that release or higher AND 1.7.x versions should be upgraded to 1.7.3 or higher
  • Pivotal Cloud Foundry Elastic Runtime versions prior to 1.6.24 should be upgraded to that release or higher AND 1.7.x versions should be upgraded to 1.7.2 or higher
  • MySQL for Pivotal Cloud Foundry versions prior to 1.6.11 should be upgraded to that release or higher, versions 1.7.x should be upgraded to 1.7.8 or higher AND 1.8.x prior to 1.8.0-edge.6 should be upgraded to that or higher
  • RabbitMQ for Pivotal Cloud Foundry versions prior to 1.5.10 should be upgraded to that release or higher
  • Redis for Pivotal Cloud Foundry versions prior to 1.4.24 should be upgraded to that release or higher AND 1.5.x versions prior to 1.5.13 should be upgraded to that release or higher
  • RiakCS for Pivotal Cloud Foundry versions prior to 1.5.12 should be upgraded to that release or higher
  • Pivotal Cloud Foundry Single Sign-on versions prior to 1.0.12 should be upgraded to that release or higher

Special Note for 1.7.x Ops Manager Deployments

The 1.7.x release line of Ops Manager includes a new feature that allows tile stemcells to “float”, which will allow Operators to update their Ops Manager deployment once rather than installing all new Services product releases. If you upgrade one Service tile in Ops Manager 1.7.x with the newly released stemcell, all tiles will automatically upgrade. For more information about the floating stemcell feature, refer to this document.

Credit

Ben Hawkes, Andy Lutomirski, Zach Riggle, Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg

References