November 2014 - Arch-security - lists.archlinux.org

[arch-security] [Arch Linux Security Advisory ASA-201411-23] wireshark-gtk: denial of service
by Levente Polyak 20 Nov '14

20 Nov '14

Arch Linux Security Advisory ASA-201411-23 ========================================== Severity: Medium Date : 2014-11-20 CVE-ID : CVE-2014-8710 CVE-2014-8711 CVE-2014-8712 CVE-2014-8713 CVE-2014-8714 Package : wireshark-gtk Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package wireshark-gtk before version 1.12.2-1 is vulnerable to multiple issues leading to denial of service. Resolution ========== Upgrade to 1.12.2-1. # pacman -Syu "wireshark-gtk>=1.12.2-1" The problems have been fixed upstream in version 1.12.2. Workaround ========== None. Description =========== - CVE-2014-8710 (out-of-bounds read) Out-of-bounds read flaw in the SigComp dissector (sigcomp-udvm) leads to denial of service while processing malformed packets. - CVE-2014-8711 (out-of-bounds read) The AMQP dissector is seeing a large value in the capture file for what it thinks should be a field specifying the number of elements in an array, resulting in undetected overflow (wrapping). - CVE-2014-8712 (stack buffer overflow) An issue in the NCP dissector while constructing strings may lead to incorrect data length, resulting in stack buffer overflow and denial of service. - CVE-2014-8713 (denial of service) An issue in the NCP dissector may lead to denial of service while accessing an uninitialized buffer. - CVE-2014-8714 (denial of service) A missing exit when the offset is not incremented in the tn5250 dissector is leading to an endless loop, resulting in denial of service. Impact ====== It may be possible to make wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. References ========== https://www.wireshark.org/lists/wireshark-users/201411/msg00004.html https://www.wireshark.org/security/wnpa-sec-2014-20.html https://www.wireshark.org/security/wnpa-sec-2014-21.html https://www.wireshark.org/security/wnpa-sec-2014-22.html https://www.wireshark.org/security/wnpa-sec-2014-23.html https://access.redhat.com/security/cve/CVE-2014-8710 https://access.redhat.com/security/cve/CVE-2014-8711 https://access.redhat.com/security/cve/CVE-2014-8712 https://access.redhat.com/security/cve/CVE-2014-8713 https://access.redhat.com/security/cve/CVE-2014-8714 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10662 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10582 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10552 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10628 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10596

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-22] wireshark-cli: denial of service
by Levente Polyak 20 Nov '14

20 Nov '14

Arch Linux Security Advisory ASA-201411-22 ========================================== Severity: Medium Date : 2014-11-20 CVE-ID : CVE-2014-8710 CVE-2014-8711 CVE-2014-8712 CVE-2014-8713 CVE-2014-8714 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package wireshark-cli before version 1.12.2-1 is vulnerable to multiple issues leading to denial of service. Resolution ========== Upgrade to 1.12.2-1. # pacman -Syu "wireshark-cli>=1.12.2-1" The problems have been fixed upstream in version 1.12.2. Workaround ========== None. Description =========== - CVE-2014-8710 (out-of-bounds read) Out-of-bounds read flaw in the SigComp dissector (sigcomp-udvm) leads to denial of service while processing malformed packets. - CVE-2014-8711 (out-of-bounds read) The AMQP dissector is seeing a large value in the capture file for what it thinks should be a field specifying the number of elements in an array, resulting in undetected overflow (wrapping). - CVE-2014-8712 (stack buffer overflow) An issue in the NCP dissector while constructing strings may lead to incorrect data length, resulting in stack buffer overflow and denial of service. - CVE-2014-8713 (denial of service) An issue in the NCP dissector may lead to denial of service while accessing an uninitialized buffer. - CVE-2014-8714 (denial of service) A missing exit when the offset is not incremented in the tn5250 dissector is leading to an endless loop, resulting in denial of service. Impact ====== It may be possible to make wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. References ========== https://www.wireshark.org/lists/wireshark-users/201411/msg00004.html https://www.wireshark.org/security/wnpa-sec-2014-20.html https://www.wireshark.org/security/wnpa-sec-2014-21.html https://www.wireshark.org/security/wnpa-sec-2014-22.html https://www.wireshark.org/security/wnpa-sec-2014-23.html https://access.redhat.com/security/cve/CVE-2014-8710 https://access.redhat.com/security/cve/CVE-2014-8711 https://access.redhat.com/security/cve/CVE-2014-8712 https://access.redhat.com/security/cve/CVE-2014-8713 https://access.redhat.com/security/cve/CVE-2014-8714 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10662 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10582 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10552 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10628 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10596

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-21] clamav: denial of service
by Levente Polyak 20 Nov '14

20 Nov '14

Arch Linux Security Advisory ASA-201411-21 ========================================== Severity: Low Date : 2014-11-20 CVE-ID : CVE-2013-6497 Package : clamav Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package clamav before version 0.98.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.98.5-1. # pacman -Syu "clamav>=0.98.5-1" The problem has been fixed upstream in version 0.98.5. Workaround ========== None. Description =========== It was discovered that clamav crashes on certain files when using 'clamscan -a' or while scanning maliciously crafted files. Impact ====== Certain JavaScript or specially crafted files processed by "clamscan" may lead to a segmentation fault resulting in denial of service. References ========== https://access.redhat.com/security/cve/CVE-2013-6497 https://bugzilla.clamav.net/show_bug.cgi?id=11088 http://seclists.org/oss-sec/2014/q4/673

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-20] avr-binutils: multiple issues
by Levente Polyak 19 Nov '14

19 Nov '14

Arch Linux Security Advisory ASA-201411-20 ========================================== Severity: Medium Date : 2014-11-19 CVE-ID : CVE-2014-8484 CVE-2014-8485 CVE-2014-8501 CVE-2014-8502 CVE-2014-8503 CVE-2014-8504 CVE-2014-8737 CVE-2014-8738 Package : avr-binutils Type : multiple issues Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package avr-binutils before version 2.24-3 is vulnerable to multiple issues including but not limited to denial of service, directory traversal, heap and stack overflow leading to possible code execution. Resolution ========== Upgrade to 2.24-3. # pacman -Syu "avr-binutils>=2.24-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2014-8484 (invalid read) Invalid read flaw leads to denial of service while parsing specially crafted files in programs using libbfd. - CVE-2014-8485 (out-of-bounds write) Lack of range checking leading to controlled write in _bfd_elf_setup_sections() which results in denial of service or possible code execution in programs using libbfd. - CVE-2014-8501 (out-of-bounds write) Out-of-bounds write when parsing specially crafted PE executable leads to denial of service in "strings", "nm" and "objdump". - CVE-2014-8502 (heap overflow) Heap buffer overflow when parsing specially crafted PE executable leads to denial of service in "objdump". - CVE-2014-8503 (stack overflow) Stack overflow in "objdump" when parsing specially crafted ihex files leads to denial of service or code execution. - CVE-2014-8504 (stack overflow) Stack overflow in the SREC parser leads to denial of service or code execution when parsing specially crafted files. - CVE-2014-8737 (directory traversal) Directory traversal vulnerability allowing arbitrary file deletion and creation. - CVE-2014-8738 (out-of-bounds write) Out-of-bounds memory write while processing a crafted "ar" archive leads to denial of service in "objdump". Impact ====== An attacker with specially crafted files can perform denial of service, directory traversal, heap and stack overflow leading to possible code execution. Programs using libbfd may also be remotely exploitable. References ========== https://access.redhat.com/security/cve/CVE-2014-8484 https://access.redhat.com/security/cve/CVE-2014-8485 https://access.redhat.com/security/cve/CVE-2014-8501 https://access.redhat.com/security/cve/CVE-2014-8502 https://access.redhat.com/security/cve/CVE-2014-8503 https://access.redhat.com/security/cve/CVE-2014-8504 https://access.redhat.com/security/cve/CVE-2014-8737 https://access.redhat.com/security/cve/CVE-2014-8738 http://seclists.org/oss-sec/2014/q4/424 http://seclists.org/oss-sec/2014/q4/599 https://bugs.archlinux.org/task/42773

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-19] mingw-w64-binutils: multiple issues
by Levente Polyak 19 Nov '14

19 Nov '14

Arch Linux Security Advisory ASA-201411-19 ========================================== Severity: Medium Date : 2014-11-19 CVE-ID : CVE-2014-8484 CVE-2014-8485 CVE-2014-8501 CVE-2014-8502 CVE-2014-8503 CVE-2014-8504 CVE-2014-8737 CVE-2014-8738 Package : mingw-w64-binutils Type : multiple issues Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package mingw-w64-binutils before version 2.24-2 is vulnerable to multiple issues including but not limited to denial of service, directory traversal, heap and stack overflow leading to possible code execution. Resolution ========== Upgrade to 2.24-2. # pacman -Syu "mingw-w64-binutils>=2.24-2" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2014-8484 (invalid read) Invalid read flaw leads to denial of service while parsing specially crafted files in programs using libbfd. - CVE-2014-8485 (out-of-bounds write) Lack of range checking leading to controlled write in _bfd_elf_setup_sections() which results in denial of service or possible code execution in programs using libbfd. - CVE-2014-8501 (out-of-bounds write) Out-of-bounds write when parsing specially crafted PE executable leads to denial of service in "strings", "nm" and "objdump". - CVE-2014-8502 (heap overflow) Heap buffer overflow when parsing specially crafted PE executable leads to denial of service in "objdump". - CVE-2014-8503 (stack overflow) Stack overflow in "objdump" when parsing specially crafted ihex files leads to denial of service or code execution. - CVE-2014-8504 (stack overflow) Stack overflow in the SREC parser leads to denial of service or code execution when parsing specially crafted files. - CVE-2014-8737 (directory traversal) Directory traversal vulnerability allowing arbitrary file deletion and creation. - CVE-2014-8738 (out-of-bounds write) Out-of-bounds memory write while processing a crafted "ar" archive leads to denial of service in "objdump". Impact ====== An attacker with specially crafted files can perform denial of service, directory traversal, heap and stack overflow leading to possible code execution. Programs using libbfd may also be remotely exploitable. References ========== https://access.redhat.com/security/cve/CVE-2014-8484 https://access.redhat.com/security/cve/CVE-2014-8485 https://access.redhat.com/security/cve/CVE-2014-8501 https://access.redhat.com/security/cve/CVE-2014-8502 https://access.redhat.com/security/cve/CVE-2014-8503 https://access.redhat.com/security/cve/CVE-2014-8504 https://access.redhat.com/security/cve/CVE-2014-8737 https://access.redhat.com/security/cve/CVE-2014-8738 http://seclists.org/oss-sec/2014/q4/424 http://seclists.org/oss-sec/2014/q4/599 https://bugs.archlinux.org/task/42773

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-18] arm-none-eabi-binutils: multiple issues
by Levente Polyak 19 Nov '14

19 Nov '14

Arch Linux Security Advisory ASA-201411-18 ========================================== Severity: Medium Date : 2014-11-19 CVE-ID : CVE-2014-8484 CVE-2014-8485 CVE-2014-8501 CVE-2014-8502 CVE-2014-8503 CVE-2014-8504 CVE-2014-8737 CVE-2014-8738 Package : arm-none-eabi-binutils Type : multiple issues Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package arm-none-eabi-binutils before version 2.24-3 is vulnerable to multiple issues including but not limited to denial of service, directory traversal, heap and stack overflow leading to possible code execution. Resolution ========== Upgrade to 2.24-3. # pacman -Syu "arm-none-eabi-binutils>=2.24-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2014-8484 (invalid read) Invalid read flaw leads to denial of service while parsing specially crafted files in programs using libbfd. - CVE-2014-8485 (out-of-bounds write) Lack of range checking leading to controlled write in _bfd_elf_setup_sections() which results in denial of service or possible code execution in programs using libbfd. - CVE-2014-8501 (out-of-bounds write) Out-of-bounds write when parsing specially crafted PE executable leads to denial of service in "strings", "nm" and "objdump". - CVE-2014-8502 (heap overflow) Heap buffer overflow when parsing specially crafted PE executable leads to denial of service in "objdump". - CVE-2014-8503 (stack overflow) Stack overflow in "objdump" when parsing specially crafted ihex files leads to denial of service or code execution. - CVE-2014-8504 (stack overflow) Stack overflow in the SREC parser leads to denial of service or code execution when parsing specially crafted files. - CVE-2014-8737 (directory traversal) Directory traversal vulnerability allowing arbitrary file deletion and creation. - CVE-2014-8738 (out-of-bounds write) Out-of-bounds memory write while processing a crafted "ar" archive leads to denial of service in "objdump". Impact ====== An attacker with specially crafted files can perform denial of service, directory traversal, heap and stack overflow leading to possible code execution. Programs using libbfd may also be remotely exploitable. References ========== https://access.redhat.com/security/cve/CVE-2014-8484 https://access.redhat.com/security/cve/CVE-2014-8485 https://access.redhat.com/security/cve/CVE-2014-8501 https://access.redhat.com/security/cve/CVE-2014-8502 https://access.redhat.com/security/cve/CVE-2014-8503 https://access.redhat.com/security/cve/CVE-2014-8504 https://access.redhat.com/security/cve/CVE-2014-8737 https://access.redhat.com/security/cve/CVE-2014-8738 http://seclists.org/oss-sec/2014/q4/424 http://seclists.org/oss-sec/2014/q4/599 https://bugs.archlinux.org/task/42773

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-17] binutils: multiple issues
by Levente Polyak 19 Nov '14

19 Nov '14

Arch Linux Security Advisory ASA-201411-17 ========================================== Severity: Medium Date : 2014-11-19 CVE-ID : CVE-2014-8484 CVE-2014-8485 CVE-2014-8501 CVE-2014-8502 CVE-2014-8503 CVE-2014-8504 CVE-2014-8737 CVE-2014-8738 Package : binutils Type : multiple issues Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package binutils before version 2.24-8 is vulnerable to multiple issues including but not limited to denial of service, directory traversal, heap and stack overflow leading to possible code execution. Resolution ========== Upgrade to 2.24-8. # pacman -Syu "binutils>=2.24-8" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2014-8484 (invalid read) Invalid read flaw leads to denial of service while parsing specially crafted files in programs using libbfd. - CVE-2014-8485 (out-of-bounds write) Lack of range checking leading to controlled write in _bfd_elf_setup_sections() which results in denial of service or possible code execution in programs using libbfd. - CVE-2014-8501 (out-of-bounds write) Out-of-bounds write when parsing specially crafted PE executable leads to denial of service in "strings", "nm" and "objdump". - CVE-2014-8502 (heap overflow) Heap buffer overflow when parsing specially crafted PE executable leads to denial of service in "objdump". - CVE-2014-8503 (stack overflow) Stack overflow in "objdump" when parsing specially crafted ihex files leads to denial of service or code execution. - CVE-2014-8504 (stack overflow) Stack overflow in the SREC parser leads to denial of service or code execution when parsing specially crafted files. - CVE-2014-8737 (directory traversal) Directory traversal vulnerability allowing arbitrary file deletion and creation. - CVE-2014-8738 (out-of-bounds write) Out-of-bounds memory write while processing a crafted "ar" archive leads to denial of service in "objdump". Impact ====== An attacker with specially crafted files can perform denial of service, directory traversal, heap and stack overflow leading to possible code execution. Programs using libbfd may also be remotely exploitable. References ========== https://access.redhat.com/security/cve/CVE-2014-8484 https://access.redhat.com/security/cve/CVE-2014-8485 https://access.redhat.com/security/cve/CVE-2014-8501 https://access.redhat.com/security/cve/CVE-2014-8502 https://access.redhat.com/security/cve/CVE-2014-8503 https://access.redhat.com/security/cve/CVE-2014-8504 https://access.redhat.com/security/cve/CVE-2014-8737 https://access.redhat.com/security/cve/CVE-2014-8738 http://seclists.org/oss-sec/2014/q4/424 http://seclists.org/oss-sec/2014/q4/599 https://bugs.archlinux.org/task/42773

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-16] ruby: denial of service
by Levente Polyak 17 Nov '14

17 Nov '14

Arch Linux Security Advisory ASA-201411-16 ========================================== Severity: Medium Date : 2014-11-17 CVE-ID : CVE-2014-8090 Package : ruby Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package ruby before version 2.1.5-1 is vulnerable to denial service through unrestricted XML entity expansion. Resolution ========== Upgrade to 2.1.5-1. # pacman -Syu "ruby>=2.1.5-1" The problem has been fixed upstream in version 2.1.5. Workaround ========== If you cannot upgrade Ruby, use this monkey patch as a workaround: class REXML::Document def document self end end Description =========== CPU exhaustion can occur as a result of recursive expansion with an empty string. When reading text nodes from an XML document, the REXML parser can be coerced into allocating extremely large string objects which can consume all of the memory on a machine, causing a denial of service. Impact ====== A remote attacker using an specially crafted XML document is able to perform denial of service through CPU and/or memory exhaustion. References ========== https://www.ruby-lang.org/en/news/2014/11/13/rexml-dos-cve-2014-8090/ https://access.redhat.com/security/cve/CVE-2014-8090

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-15] linux-lts: local denial of service, privilege escalation
by Remi Gacogne 17 Nov '14

17 Nov '14

Arch Linux Security Advisory ASA-201411-15 ========================================== Severity: Medium Date : 2014-11-17 CVE-ID : CVE-2014-3610, CVE-2014-3611, CVE-2014-3646, CVE-2014-3647, CVE-2014-7825, CVE-2014-7826, CVE-2014-8369 Package : linux-lts Type : local denial of service, privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package linux-lts before version 3.14.24-1 is vulnerable to local denial service and privilege escalation via various issues. Resolution ========== Upgrade to 3.14.24-1. # pacman -Syu "linux-lts>=3.14.24-1" The problem has been fixed upstream in version 3.14.24. Workaround ========== None. Description =========== CVE-2014-3610: The WRMSR processing functionality in the KVM subsystem in the Linux kernel does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c. CVE-2014-3611: Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation. CVE-2014-3646: arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. CVE-2014-3647: arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. CVE-2014-7825: kernel/trace/trace_syscalls.c in the Linux kernel does not properly handle private syscall numbers during use of the perf subsystem, which allows local users to cause a denial of service (out-of-bounds read and OOPS) or bypass the ASLR protection mechanism via a crafted application. CVE-2014-7826: kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the ftrace subsystem, which allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application. CVE-2014-8369: The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges. NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601. Impact ====== A local OS user may be able to cause a kernel crash in various ways, or escalate privileges. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3610 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3611 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3646 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3647 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7825 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7826 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8369 http://permalink.gmane.org/gmane.comp.security.oss.general/14526

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-14] linux: local denial of service, privilege escalation
by Remi Gacogne 17 Nov '14

17 Nov '14

Arch Linux Security Advisory ASA-201411-14 ========================================== Severity: Medium Date : 2014-11-17 CVE-ID : CVE-2014-3610, CVE-2014-3611, CVE-2014-3646, CVE-2014-3647, CVE-2014-7825, CVE-2014-7826, CVE-2014-8369, CVE-2014-8480, CVE-2014-8481 Package : linux Type : local denial of service, privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package linux before version 3.17.3-1 is vulnerable to local denial service and privilege escalation via various issues. Resolution ========== Upgrade to 3.17.3-1. # pacman -Syu "linux>=3.17.3-1" The problem has been fixed upstream in version 3.17.3. Workaround ========== None. Description =========== CVE-2014-3610: The WRMSR processing functionality in the KVM subsystem in the Linux kernel does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c. CVE-2014-3611: Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation. CVE-2014-3646: arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. CVE-2014-3647: arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. CVE-2014-7825: kernel/trace/trace_syscalls.c in the Linux kernel does not properly handle private syscall numbers during use of the perf subsystem, which allows local users to cause a denial of service (out-of-bounds read and OOPS) or bypass the ASLR protection mechanism via a crafted application. CVE-2014-7826: kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the ftrace subsystem, which allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application. CVE-2014-8369: The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges. NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601. CVE-2014-8480: The instruction decoder in arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel lacks intended decoder-table flags for certain RIP-relative instructions, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a crafted application. CVE-2014-8481: The instruction decoder in arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel does not properly handle invalid instructions, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a crafted application that triggers (1) an improperly fetched instruction or (2) an instruction that occupies too many bytes. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8480. Impact ====== A local OS user may be able to cause a kernel crash in various ways, or escalate privileges. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3610 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3611 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3646 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3647 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7825 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7826 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8369 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8480 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8481 http://permalink.gmane.org/gmane.comp.security.oss.general/14526

1 0