Debian DLA-1481-1 : linux-4.9 security update (Foreshadow)
Medium Nessus Plugin ID 112168
SynopsisThe remote Debian host is missing a security update.
DescriptionMultiple researchers have discovered a vulnerability in the way the Intel processor designs have implemented speculative execution of instructions in combination with handling of page-faults. This flaw could allow an attacker controlling an unprivileged process to read memory from arbitrary (non-user controlled) addresses, including from the kernel and all other processes running on the system or cross guest/host boundaries to read host memory.
To fully resolve these vulnerabilities it is also necessary to install updated CPU microcode (only available in Debian non-free). Common server class CPUs are covered in the update released as DLA 1446-1.
For Debian 8 'Jessie', these problems have been fixed in version 4.9.110-3+deb9u4~deb8u1.
We recommend that you upgrade your linux-4.9 packages.
NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
SolutionUpgrade the affected packages.