- Arch-security - lists.archlinux.org

[ASA-201801-9] glibc: multiple issues
by Santiago Torres-Arias 10 Jan '18

10 Jan '18

Arch Linux Security Advisory ASA-201801-9 ========================================= Severity: High Date : 2018-01-10 CVE-ID : CVE-2017-15670 CVE-2017-15671 Package : glibc Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-460 Summary ======= The package glibc before version 2.26-9 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.26-9. # pacman -Syu "glibc>=2.26-9" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-15670 (arbitrary code execution) The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by- one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string. - CVE-2017-15671 (denial of service) The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when processing the ~ operator with a long user name, potentially leading to a denial of service (memory leak). Impact ====== A remote attacker is able to execute arbitrary code on the host or crash a target application that is using glibc functions for globbing by providing a crafted input to it. References ========== http://seclists.org/oss-sec/2017/q4/119 https://sourceware.org/bugzilla/show_bug.cgi?id=22320 https://bugzilla.redhat.com/show_bug.cgi?id=1504804 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=a76376df7c07e577a951… https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=2d1bd71ec70a31b01d0… https://sourceware.org/bugzilla/show_bug.cgi?id=22325 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=f1cf98b583787cfb6278… https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=6803dda53781f7da920… https://security.archlinux.org/CVE-2017-15670 https://security.archlinux.org/CVE-2017-15671

1 0

[ASA-201801-8] lib32-glibc: multiple issues
by Santiago Torres-Arias 10 Jan '18

10 Jan '18

Arch Linux Security Advisory ASA-201801-8 ========================================= Severity: High Date : 2018-01-10 CVE-ID : CVE-2017-15670 CVE-2017-15671 Package : lib32-glibc Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-460 Summary ======= The package lib32-glibc before version 2.26-9 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.26-9. # pacman -Syu "lib32-glibc>=2.26-9" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-15670 (arbitrary code execution) The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by- one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string. - CVE-2017-15671 (denial of service) The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when processing the ~ operator with a long user name, potentially leading to a denial of service (memory leak). Impact ====== A remote attacker is able to execute arbitrary code on the host or crash a target application that is using glibc functions for globbing by providing a crafted input to it. References ========== http://seclists.org/oss-sec/2017/q4/119 https://sourceware.org/bugzilla/show_bug.cgi?id=22320 https://bugzilla.redhat.com/show_bug.cgi?id=1504804 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=a76376df7c07e577a951… https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=2d1bd71ec70a31b01d0… https://sourceware.org/bugzilla/show_bug.cgi?id=22325 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=f1cf98b583787cfb6278… https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=6803dda53781f7da920… https://security.archlinux.org/CVE-2017-15670 https://security.archlinux.org/CVE-2017-15671

1 0

[ASA-201801-7] graphicsmagick: multiple issues
by Santiago Torres-Arias 09 Jan '18

09 Jan '18

Arch Linux Security Advisory ASA-201801-7 ========================================= Severity: High Date : 2018-01-08 CVE-ID : CVE-2017-11403 CVE-2017-12935 CVE-2017-12936 CVE-2017-12937 CVE-2017-13063 CVE-2017-13064 CVE-2017-13065 CVE-2017-13066 CVE-2017-13134 CVE-2017-13776 CVE-2017-13777 CVE-2017-14165 CVE-2017-15930 CVE-2017-16547 Package : graphicsmagick Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-355 Summary ======= The package graphicsmagick before version 1.3.27-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.3.27-1. # pacman -Syu "graphicsmagick>=1.3.27-1" The problems have been fixed upstream in version 1.3.27. Workaround ========== None. Description =========== - CVE-2017-11403 (arbitrary code execution) The ReadMNGImage function in coders/png.c in GraphicsMagick before 1.3.27 has an out-of-order CloseBlob call, resulting in a use-after- free via a crafted file. - CVE-2017-12935 (arbitrary code execution) The ReadMNGImage function in coders/png.c in GraphicsMagick before 1.3.27 mishandles large MNG images, leading to an invalid memory read in the SetImageColorCallBack function in magick/image.c. - CVE-2017-12936 (arbitrary code execution) The ReadWMFImage function in coders/wmf.c in GraphicsMagick before 1.3.27 has a use-after-free issue for data associated with exception reporting. - CVE-2017-12937 (arbitrary code execution) The ReadSUNImage function in coders/sun.c in GraphicsMagick before 1.3.27 has a colormap heap-based buffer over-read. - CVE-2017-13063 (arbitrary code execution) A heap buffer overflow vulnerability was found in the function GetStyleTokens in GraphicsMagick before 1.3.27, which allow attackers to cause a denial of service, or possible remote code execution via a crafted file. - CVE-2017-13064 (arbitrary code execution) A heap buffer overflow vulnerability was found in function GetStyleTokens in GraphicsMagick before 1.3.27, which allow attackers to cause a denial of service or possible remote code execution via a crafted file. - CVE-2017-13065 (denial of service) A null pointer dereference vulnerability was found in function SVGStartElement in GraphicsMagick before 1.3.27, which allow attackers to cause a denial of service via a crafted file. - CVE-2017-13066 (denial of service) A memory leak vulnerability was found in function CloneImage in magick/image.c in GraphicsMagick before 1.3.27, which allow attackers to cause a denial of service via a crafted file. - CVE-2017-13134 (denial of service) In ImageMagick 6.9.9.1, 7.0.6.7 and GraphicsMagick before 1.3.27, a heap-based buffer over-read was found in the function SFWScan in coders/sfw.c, which allows attackers to cause a denial of service via a crafted file. - CVE-2017-13776 (denial of service) GraphicsMagick before 1.3.27 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version!=10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it. - CVE-2017-13777 (denial of service) GraphicsMagick before 1.3.27 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version==10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it. - CVE-2017-14165 (denial of service) The ReadSUNImage function in coders/sun.c in GraphicsMagick before 1.3.27 has an issue where memory allocation is excessive because it depends only on a length field in a header. This may lead to remote denial of service in the MagickMalloc function in magick/memory.c. - CVE-2017-15930 (denial of service) In ReadOneJNGImage in coders/png.c in GraphicsMagick before 1.3.27, a null pointer dereference occurs while transferring JPEG scanlines, related to a PixelPacket pointer. - CVE-2017-16547 (denial of service) The DrawImage function in magick/render.c in GraphicsMagick before 1.3.27 does not properly look for pop keywords that are associated with push keywords, which allows remote attackers to cause a denial of service (negative strncpy and application crash) or possibly have unspecified other impact via a crafted file. Impact ====== A remote attacker is able to read sensitive information, crash the application or execute arbitrary code on the host by providing a maliciously-crafted input to GraphicsMagick's convert. References ========== https://blogs.gentoo.org/ago/2017/07/12/graphicsmagick-use-after-free-in-cl… http://hg.code.sf.net/p/graphicsmagick/code/rev/d0a76868ca37 https://marc.info/?l=oss-security&m=150306448426399 https://blogs.gentoo.org/ago/2017/08/05/graphicsmagick-invalid-memory-read-… http://hg.code.sf.net/p/graphicsmagick/code/rev/cd699a44f188 http://www.openwall.com/lists/oss-security/2017/08/18/3 https://blogs.gentoo.org/ago/2017/08/05/graphicsmagick-use-after-free-in-re… http://hg.code.sf.net/p/graphicsmagick/code/rev/be898b7c97bd https://blogs.gentoo.org/ago/2017/08/05/graphicsmagick-heap-based-buffer-ov… http://hg.code.sf.net/p/graphicsmagick/code/rev/95d00d55e978 http://seclists.org/oss-sec/2017/q3/325 https://sourceforge.net/p/graphicsmagick/bugs/434/ http://hg.code.sf.net/p/graphicsmagick/code/rev/54f48ab2d52a https://sourceforge.net/p/graphicsmagick/bugs/436/ https://sourceforge.net/p/graphicsmagick/bugs/435/ https://sourceforge.net/p/graphicsmagick/bugs/430/ http://www.securityfocus.com/bid/100463 https://github.com/ImageMagick/ImageMagick/issues/670 https://github.com/ImageMagick/ImageMagick/commit/5304ae14655a67b9a3db00563… http://hg.code.sf.net/p/graphicsmagick/code/rev/1b47e0078e05 http://openwall.com/lists/oss-security/2017/08/31/2 http://hg.code.sf.net/p/graphicsmagick/code/rev/233a720bfd5e http://openwall.com/lists/oss-security/2017/08/31/1 https://blogs.gentoo.org/ago/2017/09/06/graphicsmagick-memory-allocation-fa… http://hg.code.sf.net/p/graphicsmagick/code/rev/493da54370aa https://sourceforge.net/p/graphicsmagick/bugs/518/ http://hg.code.sf.net/p/graphicsmagick/code/rev/da135eaedc3b http://hg.code.sf.net/p/graphicsmagick/code/rev/6fc54b6d2be8 https://sourceforge.net/p/graphicsmagick/bugs/517/ http://hg.code.sf.net/p/graphicsmagick/code/rev/785758bbbfcc https://security.archlinux.org/CVE-2017-11403 https://security.archlinux.org/CVE-2017-12935 https://security.archlinux.org/CVE-2017-12936 https://security.archlinux.org/CVE-2017-12937 https://security.archlinux.org/CVE-2017-13063 https://security.archlinux.org/CVE-2017-13064 https://security.archlinux.org/CVE-2017-13065 https://security.archlinux.org/CVE-2017-13066 https://security.archlinux.org/CVE-2017-13134 https://security.archlinux.org/CVE-2017-13776 https://security.archlinux.org/CVE-2017-13777 https://security.archlinux.org/CVE-2017-14165 https://security.archlinux.org/CVE-2017-15930 https://security.archlinux.org/CVE-2017-16547

1 0

[ASA-201801-6] linux-lts: access restriction bypass
by Levente Polyak 08 Jan '18

08 Jan '18

Arch Linux Security Advisory ASA-201801-6 ========================================= Severity: High Date : 2018-01-08 CVE-ID : CVE-2017-5754 Package : linux-lts Type : access restriction bypass Remote : No Link : https://security.archlinux.org/AVG-577 Summary ======= The package linux-lts before version 4.9.75-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 4.9.75-1. # pacman -Syu "linux-lts>=4.9.75-1" The problem has been fixed upstream in version 4.9.75. Workaround ========== None. Description =========== An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). This variant ("Rogue Data Load") relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker could use this flaw to read memory from arbitrary addresses, including privileged (kernel space) and all other processes running on the system by conducting targeted cache side- channel attacks. Impact ====== A local unprivileged attacker is able to read memory from arbitrary addresses including the kernel and all other processes running on the system. References ========== https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-wi… https://meltdownattack.com https://xenbits.xen.org/xsa/advisory-254.html http://blog.cyberus-technology.de/posts/2018-01-03-meltdown.html https://git.kernel.org/linus/5aa90a84589282b87666f92b6c3c917c8080a9bf https://git.kernel.org/linus/00a5ae218d57741088068799b810416ac249a9ce https://security.archlinux.org/CVE-2017-5754

1 0

[ASA-201801-5] mongodb: arbitrary code execution
by Morten Linderud 07 Jan '18

07 Jan '18

Arch Linux Security Advisory ASA-201801-5 ========================================= Severity: High Date : 2018-01-05 CVE-ID : CVE-2017-15535 Package : mongodb Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-503 Summary ======= The package mongodb before version 3.6.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.6.0-1. # pacman -Syu "mongodb>=3.6.0-1" The problem has been fixed upstream in version 3.6.0. Workaround ========== To disable wire protocol compression, users may specify disabled as the compression engine, either in the command line: --networkMessageCompressors disabled or, alternatively, in the mongod configuration file as: net: compression: compressors: disabled Description =========== MongoDB 3.4.x before 3.4.10, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a vulnerability when enabled that could be exploited by a malicious attacker to deny service or modify memory of the running process. Impact ====== A remote unprivileged attacker is able to crash the mongodb service or modify memory of the running process. References ========== https://bugs.archlinux.org/task/56379 https://jira.mongodb.org/browse/SERVER-31273 https://github.com/mongodb/mongo/commit/5ad69b851801edadbfde8fdf271f4ba7c21… https://security.archlinux.org/CVE-2017-15535

1 0

[ASA-201801-4] linux-hardened: multiple issues
by Levente Polyak 05 Jan '18

05 Jan '18

Arch Linux Security Advisory ASA-201801-4 ========================================= Severity: High Date : 2018-01-05 CVE-ID : CVE-2017-16995 CVE-2017-16996 CVE-2017-17448 CVE-2017-17449 CVE-2017-17450 CVE-2017-17558 CVE-2017-17712 CVE-2017-17741 CVE-2017-17805 CVE-2017-17806 CVE-2017-17852 CVE-2017-17853 CVE-2017-17854 CVE-2017-17855 CVE-2017-17856 CVE-2017-17857 CVE-2017-17862 CVE-2017-17863 CVE-2017-17864 CVE-2017-5754 CVE-2017-8824 Package : linux-hardened Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-574 Summary ======= The package linux-hardened before version 4.14.11.a-1 is vulnerable to multiple issues including access restriction bypass, denial of service, privilege escalation and information disclosure. Resolution ========== Upgrade to 4.14.11.a-1. # pacman -Syu "linux-hardened>=4.14.11.a-1" The problems have been fixed upstream in version 4.14.11.a. Workaround ========== BPF related issues can be circumvented by disabling unprivileged BPF: sysctl -w kernel.unprivileged_bpf_disabled=1 On systems that do not already have the dccp module loaded, CVE-2017-8824 can be mitigated by disabling it: echo >> /etc/modprobe.d/disable-dccp.conf install dccp false Description =========== - CVE-2017-16995 (privilege escalation) An arbitrary memory r/w access issue was found in the Linux kernel before 4.14.9, 4.9.72 compiled with the eBPF bpf(2) system call (CONFIG_BPF_SYSCALL) support. The issue could occur due to calculation errors in the eBPF verifier module, triggered by user supplied malicious BPF program. An unprivileged user could use this flaw to escalate their privileges on a system. Setting parameter "kernel.unprivileged_bpf_disabled=1" prevents such privilege escalation by restricting access to bpf(2) call. - CVE-2017-16996 (privilege escalation) An arbitrary memory r/w access issue was found in the Linux kernel before 4.14.9 compiled with the eBPF bpf(2) system call (CONFIG_BPF_SYSCALL) support. The issue could occur due to calculation errors in the eBPF verifier module, triggered by user supplied malicious BPF program. An unprivileged user could use this flaw to escalate their privileges on a system. Setting parameter "kernel.unprivileged_bpf_disabled=1" prevents such privilege escalation by restricting access to bpf(2) call. - CVE-2017-17448 (access restriction bypass) It has been discovered that net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for new, get, and del operations, which allows local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces. - CVE-2017-17449 (information disclosure) The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel before 4.14.11, 4.9.74, 4.4.109, 3.18.91 and 3.16.52 when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system. - CVE-2017-17450 (access restriction bypass) It has been discovered that net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allows local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces. - CVE-2017-17558 (denial of service) The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel before 4.14.8, 4.9.71, 4.4.107, 3.18.89, 3.16.52 and 3.2.97 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out- of-bounds write access) or possibly have unspecified other impact via a crafted USB device. - CVE-2017-17712 (privilege escalation) A flaw was found in the Linux kernel's implementation of raw_sendmsg before 4.14.11, 4.4.109 and 4.9.74 allowing a local attacker to panic the kernel or possibly leak kernel addresses. A local attacker, with the privilege of creating raw sockets, can abuse a possible race condition when setting the socket option to allow the kernel to automatically create ip header values and thus potentially escalate their privileges. - CVE-2017-17741 (information disclosure) The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h. - CVE-2017-17805 (denial of service) The Salsa20 encryption algorithm in the Linux kernel before 4.14.8, 4.9.71, 4.4.107, 3.18.89, 3.16.52 and 3.2.97 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG- based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable. - CVE-2017-17806 (denial of service) The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8, 4.9.71, 4.4.107, 3.18.89, 3.16.52 and 3.2.97 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization. - CVE-2017-17852 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of 32-bit ALU ops. - CVE-2017-17853 (denial of service) It has been discovered kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect BPF_RSH signed bounds calculations. - CVE-2017-17854 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (integer overflow and memory corruption) or possibly have unspecified other impact by leveraging unrestricted integer values for pointer arithmetic. - CVE-2017-17855 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging improper use of pointers in place of scalars. - CVE-2017-17856 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the lack of stack-pointer alignment enforcement. - CVE-2017-17857 (denial of service) The check_stack_boundary function in kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of invalid variable stack read operations. - CVE-2017-17862 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 and 4.9.72 ignore unreachable code, even though it would still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic issue, could possibly be used by local users for denial of service. - CVE-2017-17863 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 and 4.9.72 does not check the relationship between pointer values and the BPF stack, which allows local users to cause a denial of service (integer overflow or invalid memory access) or possibly have unspecified other impact. - CVE-2017-17864 (information disclosure) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 and 4.9.73 mishandles states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allows local users to obtain potentially sensitive address information, aka a "pointer leak." - CVE-2017-5754 (access restriction bypass) An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). This variant ("Rogue Data Load") relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker could use this flaw to read memory from arbitrary addresses, including privileged (kernel space) and all other processes running on the system by conducting targeted cache side- channel attacks. - CVE-2017-8824 (privilege escalation) A use-after-free vulnerability was found in DCCP socket code affecting the Linux kernel since 2.6.16. The dccp_disconnect function in net/dccp/proto.c allows local users to gain privileges or cause a denial of service via an AF_UNSPEC connect system call during the DCCP_LISTEN state. Impact ====== A local unprivileged attacker is able to escalate privileges, crash the system, read memory from arbitrary addresses including from the kernel and all other processes running on the system or obtain sensitive information by sniffing an nlmon interface for all Netlink activity on the system. References ========== https://bugs.archlinux.org/task/56832 https://bugs.chromium.org/p/project-zero/issues/detail?id=1454 http://www.openwall.com/lists/oss-security/2017/12/21/2 https://git.kernel.org/linus/95a762e2c8c942780948091f8f2a4f32fce1ac6f https://git.kernel.org/linus/0c17d1d2c61936401f4702e1846e2c19b200f958 https://git.kernel.org/linus/4b380c42f7d00a395feede754f0bc2292eebe6e5 https://git.kernel.org/linus/93c647643b48f0131f02e45da3bd367d80443291 https://git.kernel.org/linus/916a27901de01446bcf57ecca4783f6cff493309 https://github.com/google/syzkaller/blob/master/docs/linux/found_bugs_usb.md https://git.kernel.org/linus/48a4ff1c7bb5a32d2e396b03132d20d552c0eca7 http://openwall.com/lists/oss-security/2017/12/12/7 https://git.kernel.org/linus/8f659a03a0ba9289b9aeb9b4470e6fb263d6f483 https://git.kernel.org/linus/e39d200fa5bf5b94a0948db0dae44c1b73b84a56 https://git.kernel.org/linus/ecaaab5649781c5a0effdaf298a925063020500e https://git.kernel.org/linus/af3ff8045bbf3e32f1a448542e73abb4c8ceb6f1 https://git.kernel.org/linus/468f6eafa6c44cb2c5d8aad35e12f06c240a812a https://git.kernel.org/linus/4374f256ce8182019353c0c639bb8d0695b4c941 https://git.kernel.org/linus/bb7f0f989ca7de1153bd128a40a71709e339fa03 https://git.kernel.org/linus/179d1c5602997fef5a940c6ddcf31212cbfebd14 https://git.kernel.org/linus/a5ec6ae161d72f01411169a938fa5f8baea16e8f https://git.kernel.org/linus/ea25f914dc164c8d56b36147ecc86bc65f83c469 https://git.kernel.org/linus/c131187db2d3fa2f8bf32fdf4e9a4ef805168467 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/com… https://git.kernel.org/linus/de31796c052e47c99b1bb342bc70aa826733e862 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/com… https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-wi… https://meltdownattack.com https://xenbits.xen.org/xsa/advisory-254.html http://blog.cyberus-technology.de/posts/2018-01-03-meltdown.html https://git.kernel.org/linus/5aa90a84589282b87666f92b6c3c917c8080a9bf https://git.kernel.org/linus/00a5ae218d57741088068799b810416ac249a9ce https://git.kernel.org/linus/69c64866ce072dea1d1e59a0d61e0f66c0dffb76 https://security.archlinux.org/CVE-2017-16995 https://security.archlinux.org/CVE-2017-16996 https://security.archlinux.org/CVE-2017-17448 https://security.archlinux.org/CVE-2017-17449 https://security.archlinux.org/CVE-2017-17450 https://security.archlinux.org/CVE-2017-17558 https://security.archlinux.org/CVE-2017-17712 https://security.archlinux.org/CVE-2017-17741 https://security.archlinux.org/CVE-2017-17805 https://security.archlinux.org/CVE-2017-17806 https://security.archlinux.org/CVE-2017-17852 https://security.archlinux.org/CVE-2017-17853 https://security.archlinux.org/CVE-2017-17854 https://security.archlinux.org/CVE-2017-17855 https://security.archlinux.org/CVE-2017-17856 https://security.archlinux.org/CVE-2017-17857 https://security.archlinux.org/CVE-2017-17862 https://security.archlinux.org/CVE-2017-17863 https://security.archlinux.org/CVE-2017-17864 https://security.archlinux.org/CVE-2017-5754 https://security.archlinux.org/CVE-2017-8824

1 0

[ASA-201801-3] linux-zen: multiple issues
by Levente Polyak 05 Jan '18

05 Jan '18

Arch Linux Security Advisory ASA-201801-3 ========================================= Severity: High Date : 2018-01-05 CVE-ID : CVE-2017-16995 CVE-2017-16996 CVE-2017-17449 CVE-2017-17558 CVE-2017-17712 CVE-2017-17805 CVE-2017-17806 CVE-2017-17852 CVE-2017-17853 CVE-2017-17854 CVE-2017-17855 CVE-2017-17856 CVE-2017-17857 CVE-2017-17862 CVE-2017-17863 CVE-2017-17864 CVE-2017-5754 CVE-2017-8824 Package : linux-zen Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-571 Summary ======= The package linux-zen before version 4.14.11-1 is vulnerable to multiple issues including access restriction bypass, denial of service, privilege escalation and information disclosure. Resolution ========== Upgrade to 4.14.11-1. # pacman -Syu "linux-zen>=4.14.11-1" The problems have been fixed upstream in version 4.14.11. Workaround ========== BPF related issues can be circumvented by disabling unprivileged BPF: sysctl -w kernel.unprivileged_bpf_disabled=1 On systems that do not already have the dccp module loaded, CVE-2017-8824 can be mitigated by disabling it: echo >> /etc/modprobe.d/disable-dccp.conf install dccp false Description =========== - CVE-2017-16995 (privilege escalation) An arbitrary memory r/w access issue was found in the Linux kernel before 4.14.9, 4.9.72 compiled with the eBPF bpf(2) system call (CONFIG_BPF_SYSCALL) support. The issue could occur due to calculation errors in the eBPF verifier module, triggered by user supplied malicious BPF program. An unprivileged user could use this flaw to escalate their privileges on a system. Setting parameter "kernel.unprivileged_bpf_disabled=1" prevents such privilege escalation by restricting access to bpf(2) call. - CVE-2017-16996 (privilege escalation) An arbitrary memory r/w access issue was found in the Linux kernel before 4.14.9 compiled with the eBPF bpf(2) system call (CONFIG_BPF_SYSCALL) support. The issue could occur due to calculation errors in the eBPF verifier module, triggered by user supplied malicious BPF program. An unprivileged user could use this flaw to escalate their privileges on a system. Setting parameter "kernel.unprivileged_bpf_disabled=1" prevents such privilege escalation by restricting access to bpf(2) call. - CVE-2017-17449 (information disclosure) The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel before 4.14.11, 4.9.74, 4.4.109, 3.18.91 and 3.16.52 when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system. - CVE-2017-17558 (denial of service) The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel before 4.14.8, 4.9.71, 4.4.107, 3.18.89, 3.16.52 and 3.2.97 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out- of-bounds write access) or possibly have unspecified other impact via a crafted USB device. - CVE-2017-17712 (privilege escalation) A flaw was found in the Linux kernel's implementation of raw_sendmsg before 4.14.11, 4.4.109 and 4.9.74 allowing a local attacker to panic the kernel or possibly leak kernel addresses. A local attacker, with the privilege of creating raw sockets, can abuse a possible race condition when setting the socket option to allow the kernel to automatically create ip header values and thus potentially escalate their privileges. - CVE-2017-17805 (denial of service) The Salsa20 encryption algorithm in the Linux kernel before 4.14.8, 4.9.71, 4.4.107, 3.18.89, 3.16.52 and 3.2.97 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG- based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable. - CVE-2017-17806 (denial of service) The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8, 4.9.71, 4.4.107, 3.18.89, 3.16.52 and 3.2.97 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization. - CVE-2017-17852 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of 32-bit ALU ops. - CVE-2017-17853 (denial of service) It has been discovered kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect BPF_RSH signed bounds calculations. - CVE-2017-17854 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (integer overflow and memory corruption) or possibly have unspecified other impact by leveraging unrestricted integer values for pointer arithmetic. - CVE-2017-17855 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging improper use of pointers in place of scalars. - CVE-2017-17856 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the lack of stack-pointer alignment enforcement. - CVE-2017-17857 (denial of service) The check_stack_boundary function in kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of invalid variable stack read operations. - CVE-2017-17862 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 and 4.9.72 ignore unreachable code, even though it would still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic issue, could possibly be used by local users for denial of service. - CVE-2017-17863 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 and 4.9.72 does not check the relationship between pointer values and the BPF stack, which allows local users to cause a denial of service (integer overflow or invalid memory access) or possibly have unspecified other impact. - CVE-2017-17864 (information disclosure) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 and 4.9.73 mishandles states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allows local users to obtain potentially sensitive address information, aka a "pointer leak." - CVE-2017-5754 (access restriction bypass) An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). This variant ("Rogue Data Load") relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker could use this flaw to read memory from arbitrary addresses, including privileged (kernel space) and all other processes running on the system by conducting targeted cache side- channel attacks. - CVE-2017-8824 (privilege escalation) A use-after-free vulnerability was found in DCCP socket code affecting the Linux kernel since 2.6.16. The dccp_disconnect function in net/dccp/proto.c allows local users to gain privileges or cause a denial of service via an AF_UNSPEC connect system call during the DCCP_LISTEN state. Impact ====== A local unprivileged attacker is able to escalate privileges, crash the system, read memory from arbitrary addresses including from the kernel and all other processes running on the system or obtain sensitive information by sniffing an nlmon interface for all Netlink activity on the system. References ========== https://bugs.archlinux.org/task/56832 https://bugs.chromium.org/p/project-zero/issues/detail?id=1454 http://www.openwall.com/lists/oss-security/2017/12/21/2 https://git.kernel.org/linus/95a762e2c8c942780948091f8f2a4f32fce1ac6f https://git.kernel.org/linus/0c17d1d2c61936401f4702e1846e2c19b200f958 https://git.kernel.org/linus/93c647643b48f0131f02e45da3bd367d80443291 https://github.com/google/syzkaller/blob/master/docs/linux/found_bugs_usb.md https://git.kernel.org/linus/48a4ff1c7bb5a32d2e396b03132d20d552c0eca7 http://openwall.com/lists/oss-security/2017/12/12/7 https://git.kernel.org/linus/8f659a03a0ba9289b9aeb9b4470e6fb263d6f483 https://git.kernel.org/linus/ecaaab5649781c5a0effdaf298a925063020500e https://git.kernel.org/linus/af3ff8045bbf3e32f1a448542e73abb4c8ceb6f1 https://git.kernel.org/linus/468f6eafa6c44cb2c5d8aad35e12f06c240a812a https://git.kernel.org/linus/4374f256ce8182019353c0c639bb8d0695b4c941 https://git.kernel.org/linus/bb7f0f989ca7de1153bd128a40a71709e339fa03 https://git.kernel.org/linus/179d1c5602997fef5a940c6ddcf31212cbfebd14 https://git.kernel.org/linus/a5ec6ae161d72f01411169a938fa5f8baea16e8f https://git.kernel.org/linus/ea25f914dc164c8d56b36147ecc86bc65f83c469 https://git.kernel.org/linus/c131187db2d3fa2f8bf32fdf4e9a4ef805168467 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/com… https://git.kernel.org/linus/de31796c052e47c99b1bb342bc70aa826733e862 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/com… https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-wi… https://meltdownattack.com https://xenbits.xen.org/xsa/advisory-254.html http://blog.cyberus-technology.de/posts/2018-01-03-meltdown.html https://git.kernel.org/linus/5aa90a84589282b87666f92b6c3c917c8080a9bf https://git.kernel.org/linus/00a5ae218d57741088068799b810416ac249a9ce https://git.kernel.org/linus/69c64866ce072dea1d1e59a0d61e0f66c0dffb76 https://security.archlinux.org/CVE-2017-16995 https://security.archlinux.org/CVE-2017-16996 https://security.archlinux.org/CVE-2017-17449 https://security.archlinux.org/CVE-2017-17558 https://security.archlinux.org/CVE-2017-17712 https://security.archlinux.org/CVE-2017-17805 https://security.archlinux.org/CVE-2017-17806 https://security.archlinux.org/CVE-2017-17852 https://security.archlinux.org/CVE-2017-17853 https://security.archlinux.org/CVE-2017-17854 https://security.archlinux.org/CVE-2017-17855 https://security.archlinux.org/CVE-2017-17856 https://security.archlinux.org/CVE-2017-17857 https://security.archlinux.org/CVE-2017-17862 https://security.archlinux.org/CVE-2017-17863 https://security.archlinux.org/CVE-2017-17864 https://security.archlinux.org/CVE-2017-5754 https://security.archlinux.org/CVE-2017-8824

1 0

[ASA-201801-2] linux-lts: multiple issues
by Levente Polyak 05 Jan '18

05 Jan '18

Arch Linux Security Advisory ASA-201801-2 ========================================= Severity: High Date : 2018-01-05 CVE-ID : CVE-2017-16995 CVE-2017-17449 CVE-2017-17558 CVE-2017-17712 CVE-2017-17805 CVE-2017-17806 CVE-2017-17862 CVE-2017-17863 CVE-2017-17864 Package : linux-lts Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-561 Summary ======= The package linux-lts before version 4.9.74-1 is vulnerable to multiple issues including denial of service, privilege escalation and information disclosure. Resolution ========== Upgrade to 4.9.74-1. # pacman -Syu "linux-lts>=4.9.74-1" The problems have been fixed upstream in version 4.9.74. Workaround ========== BPF related issues can be circumvented by disabling unprivileged BPF: sysctl -w kernel.unprivileged_bpf_disabled=1 Description =========== - CVE-2017-16995 (privilege escalation) An arbitrary memory r/w access issue was found in the Linux kernel before 4.14.9, 4.9.72 compiled with the eBPF bpf(2) system call (CONFIG_BPF_SYSCALL) support. The issue could occur due to calculation errors in the eBPF verifier module, triggered by user supplied malicious BPF program. An unprivileged user could use this flaw to escalate their privileges on a system. Setting parameter "kernel.unprivileged_bpf_disabled=1" prevents such privilege escalation by restricting access to bpf(2) call. - CVE-2017-17449 (information disclosure) The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel before 4.14.11, 4.9.74, 4.4.109, 3.18.91 and 3.16.52 when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system. - CVE-2017-17558 (denial of service) The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel before 4.14.8, 4.9.71, 4.4.107, 3.18.89, 3.16.52 and 3.2.97 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out- of-bounds write access) or possibly have unspecified other impact via a crafted USB device. - CVE-2017-17712 (privilege escalation) A flaw was found in the Linux kernel's implementation of raw_sendmsg before 4.14.11, 4.4.109 and 4.9.74 allowing a local attacker to panic the kernel or possibly leak kernel addresses. A local attacker, with the privilege of creating raw sockets, can abuse a possible race condition when setting the socket option to allow the kernel to automatically create ip header values and thus potentially escalate their privileges. - CVE-2017-17805 (denial of service) The Salsa20 encryption algorithm in the Linux kernel before 4.14.8, 4.9.71, 4.4.107, 3.18.89, 3.16.52 and 3.2.97 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG- based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable. - CVE-2017-17806 (denial of service) The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8, 4.9.71, 4.4.107, 3.18.89, 3.16.52 and 3.2.97 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization. - CVE-2017-17862 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 and 4.9.72 ignore unreachable code, even though it would still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic issue, could possibly be used by local users for denial of service. - CVE-2017-17863 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 and 4.9.72 does not check the relationship between pointer values and the BPF stack, which allows local users to cause a denial of service (integer overflow or invalid memory access) or possibly have unspecified other impact. - CVE-2017-17864 (information disclosure) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 and 4.9.73 mishandles states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allows local users to obtain potentially sensitive address information, aka a "pointer leak." Impact ====== A local unprivileged attacker is able to escalate privileges, crash the system or obtain sensitive information by sniffing an nlmon interface for all Netlink activity on the system. References ========== https://bugs.chromium.org/p/project-zero/issues/detail?id=1454 http://www.openwall.com/lists/oss-security/2017/12/21/2 https://git.kernel.org/linus/95a762e2c8c942780948091f8f2a4f32fce1ac6f https://git.kernel.org/linus/93c647643b48f0131f02e45da3bd367d80443291 https://github.com/google/syzkaller/blob/master/docs/linux/found_bugs_usb.md https://git.kernel.org/linus/48a4ff1c7bb5a32d2e396b03132d20d552c0eca7 http://openwall.com/lists/oss-security/2017/12/12/7 https://git.kernel.org/linus/8f659a03a0ba9289b9aeb9b4470e6fb263d6f483 https://git.kernel.org/linus/ecaaab5649781c5a0effdaf298a925063020500e https://git.kernel.org/linus/af3ff8045bbf3e32f1a448542e73abb4c8ceb6f1 https://git.kernel.org/linus/c131187db2d3fa2f8bf32fdf4e9a4ef805168467 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/com… https://git.kernel.org/linus/de31796c052e47c99b1bb342bc70aa826733e862 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/com… https://security.archlinux.org/CVE-2017-16995 https://security.archlinux.org/CVE-2017-17449 https://security.archlinux.org/CVE-2017-17558 https://security.archlinux.org/CVE-2017-17712 https://security.archlinux.org/CVE-2017-17805 https://security.archlinux.org/CVE-2017-17806 https://security.archlinux.org/CVE-2017-17862 https://security.archlinux.org/CVE-2017-17863 https://security.archlinux.org/CVE-2017-17864

1 0

[ASA-201801-1] linux: multiple issues
by Levente Polyak 05 Jan '18

05 Jan '18

Arch Linux Security Advisory ASA-201801-1 ========================================= Severity: High Date : 2018-01-05 CVE-ID : CVE-2017-16995 CVE-2017-16996 CVE-2017-17449 CVE-2017-17558 CVE-2017-17712 CVE-2017-17805 CVE-2017-17806 CVE-2017-17852 CVE-2017-17853 CVE-2017-17854 CVE-2017-17855 CVE-2017-17856 CVE-2017-17857 CVE-2017-17862 CVE-2017-17863 CVE-2017-17864 CVE-2017-5754 CVE-2017-8824 Package : linux Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-552 Summary ======= The package linux before version 4.14.11-1 is vulnerable to multiple issues including access restriction bypass, denial of service, privilege escalation and information disclosure. Resolution ========== Upgrade to 4.14.11-1. # pacman -Syu "linux>=4.14.11-1" The problems have been fixed upstream in version 4.14.11. Workaround ========== BPF related issues can be circumvented by disabling unprivileged BPF: sysctl -w kernel.unprivileged_bpf_disabled=1 On systems that do not already have the dccp module loaded, CVE-2017-8824 can be mitigated by disabling it: echo >> /etc/modprobe.d/disable-dccp.conf install dccp false Description =========== - CVE-2017-16995 (privilege escalation) An arbitrary memory r/w access issue was found in the Linux kernel before 4.14.9, 4.9.72 compiled with the eBPF bpf(2) system call (CONFIG_BPF_SYSCALL) support. The issue could occur due to calculation errors in the eBPF verifier module, triggered by user supplied malicious BPF program. An unprivileged user could use this flaw to escalate their privileges on a system. Setting parameter "kernel.unprivileged_bpf_disabled=1" prevents such privilege escalation by restricting access to bpf(2) call. - CVE-2017-16996 (privilege escalation) An arbitrary memory r/w access issue was found in the Linux kernel before 4.14.9 compiled with the eBPF bpf(2) system call (CONFIG_BPF_SYSCALL) support. The issue could occur due to calculation errors in the eBPF verifier module, triggered by user supplied malicious BPF program. An unprivileged user could use this flaw to escalate their privileges on a system. Setting parameter "kernel.unprivileged_bpf_disabled=1" prevents such privilege escalation by restricting access to bpf(2) call. - CVE-2017-17449 (information disclosure) The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel before 4.14.11, 4.9.74, 4.4.109, 3.18.91 and 3.16.52 when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system. - CVE-2017-17558 (denial of service) The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel before 4.14.8, 4.9.71, 4.4.107, 3.18.89, 3.16.52 and 3.2.97 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out- of-bounds write access) or possibly have unspecified other impact via a crafted USB device. - CVE-2017-17712 (privilege escalation) A flaw was found in the Linux kernel's implementation of raw_sendmsg before 4.14.11, 4.4.109 and 4.9.74 allowing a local attacker to panic the kernel or possibly leak kernel addresses. A local attacker, with the privilege of creating raw sockets, can abuse a possible race condition when setting the socket option to allow the kernel to automatically create ip header values and thus potentially escalate their privileges. - CVE-2017-17805 (denial of service) The Salsa20 encryption algorithm in the Linux kernel before 4.14.8, 4.9.71, 4.4.107, 3.18.89, 3.16.52 and 3.2.97 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG- based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable. - CVE-2017-17806 (denial of service) The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8, 4.9.71, 4.4.107, 3.18.89, 3.16.52 and 3.2.97 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization. - CVE-2017-17852 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of 32-bit ALU ops. - CVE-2017-17853 (denial of service) It has been discovered kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect BPF_RSH signed bounds calculations. - CVE-2017-17854 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (integer overflow and memory corruption) or possibly have unspecified other impact by leveraging unrestricted integer values for pointer arithmetic. - CVE-2017-17855 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging improper use of pointers in place of scalars. - CVE-2017-17856 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the lack of stack-pointer alignment enforcement. - CVE-2017-17857 (denial of service) The check_stack_boundary function in kernel/bpf/verifier.c in the Linux kernel before 4.14.9 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of invalid variable stack read operations. - CVE-2017-17862 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 and 4.9.72 ignore unreachable code, even though it would still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic issue, could possibly be used by local users for denial of service. - CVE-2017-17863 (denial of service) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 and 4.9.72 does not check the relationship between pointer values and the BPF stack, which allows local users to cause a denial of service (integer overflow or invalid memory access) or possibly have unspecified other impact. - CVE-2017-17864 (information disclosure) It has been discovered that kernel/bpf/verifier.c in the Linux kernel before 4.14.9 and 4.9.73 mishandles states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allows local users to obtain potentially sensitive address information, aka a "pointer leak." - CVE-2017-5754 (access restriction bypass) An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). This variant ("Rogue Data Load") relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker could use this flaw to read memory from arbitrary addresses, including privileged (kernel space) and all other processes running on the system by conducting targeted cache side- channel attacks. - CVE-2017-8824 (privilege escalation) A use-after-free vulnerability was found in DCCP socket code affecting the Linux kernel since 2.6.16. The dccp_disconnect function in net/dccp/proto.c allows local users to gain privileges or cause a denial of service via an AF_UNSPEC connect system call during the DCCP_LISTEN state. Impact ====== A local unprivileged attacker is able to escalate privileges, crash the system, read memory from arbitrary addresses including from the kernel and all other processes running on the system or obtain sensitive information by sniffing an nlmon interface for all Netlink activity on the system. References ========== https://bugs.archlinux.org/task/56832 https://bugs.chromium.org/p/project-zero/issues/detail?id=1454 http://www.openwall.com/lists/oss-security/2017/12/21/2 https://git.kernel.org/linus/95a762e2c8c942780948091f8f2a4f32fce1ac6f https://git.kernel.org/linus/0c17d1d2c61936401f4702e1846e2c19b200f958 https://git.kernel.org/linus/93c647643b48f0131f02e45da3bd367d80443291 https://github.com/google/syzkaller/blob/master/docs/linux/found_bugs_usb.md https://git.kernel.org/linus/48a4ff1c7bb5a32d2e396b03132d20d552c0eca7 http://openwall.com/lists/oss-security/2017/12/12/7 https://git.kernel.org/linus/8f659a03a0ba9289b9aeb9b4470e6fb263d6f483 https://git.kernel.org/linus/ecaaab5649781c5a0effdaf298a925063020500e https://git.kernel.org/linus/af3ff8045bbf3e32f1a448542e73abb4c8ceb6f1 https://git.kernel.org/linus/468f6eafa6c44cb2c5d8aad35e12f06c240a812a https://git.kernel.org/linus/4374f256ce8182019353c0c639bb8d0695b4c941 https://git.kernel.org/linus/bb7f0f989ca7de1153bd128a40a71709e339fa03 https://git.kernel.org/linus/179d1c5602997fef5a940c6ddcf31212cbfebd14 https://git.kernel.org/linus/a5ec6ae161d72f01411169a938fa5f8baea16e8f https://git.kernel.org/linus/ea25f914dc164c8d56b36147ecc86bc65f83c469 https://git.kernel.org/linus/c131187db2d3fa2f8bf32fdf4e9a4ef805168467 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/com… https://git.kernel.org/linus/de31796c052e47c99b1bb342bc70aa826733e862 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/com… https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-wi… https://meltdownattack.com https://xenbits.xen.org/xsa/advisory-254.html http://blog.cyberus-technology.de/posts/2018-01-03-meltdown.html https://git.kernel.org/linus/5aa90a84589282b87666f92b6c3c917c8080a9bf https://git.kernel.org/linus/00a5ae218d57741088068799b810416ac249a9ce https://git.kernel.org/linus/69c64866ce072dea1d1e59a0d61e0f66c0dffb76 https://security.archlinux.org/CVE-2017-16995 https://security.archlinux.org/CVE-2017-16996 https://security.archlinux.org/CVE-2017-17449 https://security.archlinux.org/CVE-2017-17558 https://security.archlinux.org/CVE-2017-17712 https://security.archlinux.org/CVE-2017-17805 https://security.archlinux.org/CVE-2017-17806 https://security.archlinux.org/CVE-2017-17852 https://security.archlinux.org/CVE-2017-17853 https://security.archlinux.org/CVE-2017-17854 https://security.archlinux.org/CVE-2017-17855 https://security.archlinux.org/CVE-2017-17856 https://security.archlinux.org/CVE-2017-17857 https://security.archlinux.org/CVE-2017-17862 https://security.archlinux.org/CVE-2017-17863 https://security.archlinux.org/CVE-2017-17864 https://security.archlinux.org/CVE-2017-5754 https://security.archlinux.org/CVE-2017-8824

1 0

[ASA-201712-11] lib32-openssl-1.0: multiple issues
by Jelle van der Waa 17 Dec '17

17 Dec '17

Arch Linux Security Advisory ASA-201712-11 ========================================== Severity: Medium Date : 2017-12-17 CVE-ID : CVE-2017-3735 CVE-2017-3736 CVE-2017-3737 CVE-2017-3738 Package : lib32-openssl-1.0 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-480 Summary ======= The package lib32-openssl-1.0 before version 1.0.2.n-1 is vulnerable to multiple issues including information disclosure, private key recovery and denial of service. Resolution ========== Upgrade to 1.0.2.n-1. # pacman -Syu "lib32-openssl-1.0>=1.0.2.n-1" The problems have been fixed upstream in version 1.0.2.n. Workaround ========== None. Description =========== - CVE-2017-3735 (denial of service) A security issue has been found in OpenSSL < 1.1.0g. If an X.509 certificate has a malformed IPAddressFamily extension, OpenSSL could do a one-byte buffer overread. The most likely result would be an erroneous display of the certificate in text format. - CVE-2017-3736 (information disclosure) A carry propagation bug has been found in OpenSSL < 1.1.0g in the x86_64 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen. - CVE-2017-3737 (information disclosure) OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. - CVE-2017-3738 (private key recovery) There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. Impact ====== A remote attacker can cause a denial of service via a crafted X.509 certificate. Furthermore a remote attacker with online access to an unpatched system on a vulnerable architecture can access sensitive information like a private key. References ========== https://www.openssl.org/news/vulnerabilities.html#2017-3735 https://www.openssl.org/news/secadv/20170828.txt https://github.com/openssl/openssl/commit/b23171744b01e473ebbfd6edad70c1c38… https://www.openssl.org/news/vulnerabilities.html#2017-3736 https://www.openssl.org/news/secadv/20171102.txt https://github.com/openssl/openssl/commit/668a709a8d7ea374ee72ad2d43ac72ec6… https://www.openssl.org/news/vulnerabilities.html#2017-3737 https://www.openssl.org/news/secadv/20171207.txt https://github.com/openssl/openssl/commit/898fb884b706aaeb283de4812340bb0bd… https://www.openssl.org/news/vulnerabilities.html#2017-3738 https://github.com/openssl/openssl/commit/5630661aecbea5fe3c4740f5fea744a1f… https://security.archlinux.org/CVE-2017-3735 https://security.archlinux.org/CVE-2017-3736 https://security.archlinux.org/CVE-2017-3737 https://security.archlinux.org/CVE-2017-3738

1 0