Debian DSA-3434-1 : linux - security update

Medium Nessus Plugin ID 87741

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leak.

- CVE-2015-7513 It was discovered that a local user permitted to use the x86 KVM subsystem could configure the PIT emulation to cause a denial of service (crash).

- CVE-2015-7550 Dmitry Vyukov discovered a race condition in the keyring subsystem that allows a local user to cause a denial of service (crash).

- CVE-2015-8543 It was discovered that a local user permitted to create raw sockets could cause a denial-of-service by specifying an invalid protocol number for the socket.
The attacker must have the CAP_NET_RAW capability.

- CVE-2015-8550 Felix Wilhelm of ERNW discovered that the Xen PV backend drivers may read critical data from shared memory multiple times. This flaw can be used by a guest kernel to cause a denial of service (crash) on the host, or possibly for privilege escalation.

- CVE-2015-8551 / CVE-2015-8552 Konrad Rzeszutek Wilk of Oracle discovered that the Xen PCI backend driver does not adequately validate the device state when a guest configures MSIs. This flaw can be used by a guest kernel to cause a denial of service (crash or disk space exhaustion) on the host.

- CVE-2015-8569 Dmitry Vyukov discovered a flaw in the PPTP sockets implementation that leads to an information leak to local users.

- CVE-2015-8575 David Miller discovered a flaw in the Bluetooth SCO sockets implementation that leads to an information leak to local users.

- CVE-2015-8709 Jann Horn discovered a flaw in the permission checks for use of the ptrace feature. A local user who has the CAP_SYS_PTRACE capability within their own user namespace could use this flaw for privilege escalation if a more privileged process ever enters that user namespace. This affects at least the LXC system.

In addition, this update fixes some regressions in the previous update :

- #808293 A regression in the UDP implementation prevented freeradius and some other applications from receiving data.

- #808602 / #808953

A regression in the USB XHCI driver prevented use of some devices in USB 3 SuperSpeed ports.

- #808973

A fix to the radeon driver interacted with an existing bug to cause a crash at boot when using some AMD/ATI graphics cards. This issue only affects wheezy.

Solution

Upgrade the linux packages.

For the oldstable distribution (wheezy), these problems have been fixed in version 3.2.73-2+deb7u2. The oldstable distribution (wheezy) is not affected by CVE-2015-8709.

For the stable distribution (jessie), these problems have been fixed in version 3.16.7-ckt20-1+deb8u2. CVE-2015-8543 was already fixed in version 3.16.7-ckt20-1+deb8u1.

See Also

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808293

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808602

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808953

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808973

https://security-tracker.debian.org/tracker/CVE-2015-7513

https://security-tracker.debian.org/tracker/CVE-2015-7550

https://security-tracker.debian.org/tracker/CVE-2015-8543

https://security-tracker.debian.org/tracker/CVE-2015-8550

https://security-tracker.debian.org/tracker/CVE-2015-8551

https://security-tracker.debian.org/tracker/CVE-2015-8552

https://security-tracker.debian.org/tracker/CVE-2015-8569

https://security-tracker.debian.org/tracker/CVE-2015-8575

https://security-tracker.debian.org/tracker/CVE-2015-8709

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808293

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808602

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808953

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=808973

https://security-tracker.debian.org/tracker/CVE-2015-8709

https://security-tracker.debian.org/tracker/CVE-2015-8543

https://packages.debian.org/source/wheezy/linux

https://packages.debian.org/source/jessie/linux

https://www.debian.org/security/2016/dsa-3434

Plugin Details

Severity: Medium

ID: 87741

File Name: debian_DSA-3434.nasl

Version: 2.7

Type: local

Agent: unix

Published: 2016/01/06

Updated: 2018/12/18

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 6.9

Temporal Score: 5.1

Vector: CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 8.2

Temporal Score: 7.1

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:linux, cpe:/o:debian:debian_linux:7.0, cpe:/o:debian:debian_linux:8.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2016/01/05

Reference Information

CVE: CVE-2015-7513, CVE-2015-7550, CVE-2015-8543, CVE-2015-8550, CVE-2015-8551, CVE-2015-8552, CVE-2015-8569, CVE-2015-8575, CVE-2015-8709

DSA: 3434