Debian DSA-2926-1 : linux - security update
high Nessus Plugin ID 73971
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote Debian host is missing a security-related update.Description
Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leaks or privilege escalation :- CVE-2014-0196 Jiri Slaby discovered a race condition in the pty layer, which could lead to denial of service or privilege escalation.
- CVE-2014-1737 / CVE-2014-1738 Matthew Daley discovered that missing input sanitising in the FDRAWCMD ioctl and an information leak could result in privilege escalation.
- CVE-2014-2851 Incorrect reference counting in the ping_init_sock() function allows denial of service or privilege escalation.
- CVE-2014-3122 Incorrect locking of memory can result in local denial of service.
Solution
Upgrade the linux packages.For the stable distribution (wheezy), these problems have been fixed in version 3.2.57-3+deb7u1. This update also fixes a regression in the isci driver and suspend problems with certain AMD CPUs (introduced in the updated kernel from the Wheezy 7.5 point release).
See Also
https://security-tracker.debian.org/tracker/CVE-2014-0196
https://security-tracker.debian.org/tracker/CVE-2014-1737
https://security-tracker.debian.org/tracker/CVE-2014-1738
https://security-tracker.debian.org/tracker/CVE-2014-2851
Plugin Details
Severity: High
ID: 73971
File Name: debian_DSA-2926.nasl
Version: 1.13
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 5/13/2014
Updated: 1/11/2021
Dependencies: ssh_get_info.nasl
Risk Information
VPR
Risk Factor: Critical
Score: 9.4
CVSS v2
Risk Factor: High
Base Score: 7.2
Temporal Score: 6.3
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Temporal Vector: E:H/RL:OF/RC:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:linux, cpe:/o:debian:debian_linux:7.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/12/2014
Vulnerability Publication Date: 4/14/2014
Exploitable With
CANVAS (CANVAS)
Core Impact
Reference Information
CVE: CVE-2014-0196, CVE-2014-1737, CVE-2014-1738, CVE-2014-2851, CVE-2014-3122
DSA: 2926