Debian DLA-1481-1 : linux-4.9 security update (Foreshadow)
Medium Nessus Plugin ID 112168
SynopsisThe remote Debian host is missing a security update.
DescriptionMultiple researchers have discovered a vulnerability in the way the
Intel processor designs have implemented speculative execution of
instructions in combination with handling of page-faults. This flaw
could allow an attacker controlling an unprivileged process to read
memory from arbitrary (non-user controlled) addresses, including from
the kernel and all other processes running on the system or cross
guest/host boundaries to read host memory.
To fully resolve these vulnerabilities it is also necessary to install
updated CPU microcode (only available in Debian non-free). Common
server class CPUs are covered in the update released as DLA 1446-1.
For Debian 8 'Jessie', these problems have been fixed in version
We recommend that you upgrade your linux-4.9 packages.
NOTE: Tenable Network Security has extracted the preceding description
block directly from the DLA security advisory. Tenable has attempted
to automatically clean and format it as much as possible without
introducing additional issues.
SolutionUpgrade the affected packages.