Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3420-1)

critical Nessus Plugin ID 103323

Synopsis

The remote Ubuntu host is missing one or more security updates.

Description

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3420-1 advisory.

- The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space. (CVE-2017-1000251)

- The sanity_check_ckpt function in fs/f2fs/super.c in the Linux kernel before 4.12.4 does not validate the blkoff and segno arrays, which allows local users to gain privileges via unspecified vectors.
(CVE-2017-10663)

- In /drivers/isdn/i4l/isdn_net.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check which can cause a buffer overflow. This affects the Linux kernel 4.9-stable tree, 4.12-stable tree, 3.18-stable tree, and 4.4-stable tree. (CVE-2017-12762)

- The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.11.5 allows local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value, aka a double fetch vulnerability.
(CVE-2017-8831)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel package.

See Also

https://ubuntu.com/security/notices/USN-3420-1

Plugin Details

Severity: Critical

ID: 103323

File Name: ubuntu_USN-3420-1.nasl

Version: 3.10

Type: local

Agent: unix

Published: 9/19/2017

Updated: 1/9/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.0

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2017-12762

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-96-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-96-powerpc-e500mc, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-96-powerpc-smp, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-96-powerpc64-emb, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-96-powerpc64-smp, cpe:/o:canonical:ubuntu_linux:16.04:-:lts, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1007-kvm, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1031-gke, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1035-aws, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1074-raspi2, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1076-snapdragon, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-96-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-96-generic-lpae

Required KB Items: Host/cpu, Host/Debian/dpkg-l, Host/Ubuntu, Host/Ubuntu/release

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/18/2017

Vulnerability Publication Date: 5/8/2017

Reference Information

CVE: CVE-2017-1000251, CVE-2017-10663, CVE-2017-12762, CVE-2017-8831

USN: 3420-1