ALT-BU-2017-3078-1
Branch p8 update bulletin.
Package kernel-image-un-def updated to version 4.9.24-alt0.M80P.1 for branch p8 in task 182068.
Closed vulnerabilities
BDU:2017-01085
Уязвимость драйвера drivers/char/virtio_console.c операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2017-01088
Уязвимость операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2017-01089
Уязвимость операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2017-01547
Уязвимость операционной системы Linux, позволяющая нарушителю считывать или записывать в ячейки памяти ядра
BDU:2017-01571
Уязвимость компонента crypto/ahash.c ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2017-7618
crypto/ahash.c in the Linux kernel through 4.10.9 allows attackers to cause a denial of service (API operation calling its own callback, and infinite recursion) by triggering EBUSY on a full queue.
- http://marc.info/?l=linux-crypto-vger&m=149181655623850&w=2
- http://marc.info/?l=linux-crypto-vger&m=149181655623850&w=2
- 97534
- 97534
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03800en_us
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03800en_us
Modified: 2024-11-21
CVE-2017-7889
The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file, related to arch/x86/mm/init.c and drivers/char/mem.c.
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a4866aa812518ed1a37d8ea0c881dc946409de94
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a4866aa812518ed1a37d8ea0c881dc946409de94
- DSA-3945
- DSA-3945
- http://www.openwall.com/lists/oss-security/2017/04/16/4
- http://www.openwall.com/lists/oss-security/2017/04/16/4
- 97690
- 97690
- RHSA-2017:1842
- RHSA-2017:1842
- RHSA-2017:2077
- RHSA-2017:2077
- RHSA-2017:2669
- RHSA-2017:2669
- RHSA-2018:1854
- RHSA-2018:1854
- https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=b8f254aa17f720053054c4ecff3920973a83b9d6
- https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=b8f254aa17f720053054c4ecff3920973a83b9d6
- https://github.com/torvalds/linux/commit/a4866aa812518ed1a37d8ea0c881dc946409de94
- https://github.com/torvalds/linux/commit/a4866aa812518ed1a37d8ea0c881dc946409de94
- USN-3583-1
- USN-3583-1
- USN-3583-2
- USN-3583-2
Modified: 2024-11-21
CVE-2017-8063
drivers/media/usb/dvb-usb/cxusb.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.12
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.12
- [oss-security] 20170416 Silently (or obliviously) partially-fixed CONFIG_STRICT_DEVMEM bypass
- [oss-security] 20170416 Silently (or obliviously) partially-fixed CONFIG_STRICT_DEVMEM bypass
- 97974
- 97974
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3f190e3aec212fc8c61e202c51400afa7384d4bc
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3f190e3aec212fc8c61e202c51400afa7384d4bc
- https://github.com/torvalds/linux/commit/3f190e3aec212fc8c61e202c51400afa7384d4bc
- https://github.com/torvalds/linux/commit/3f190e3aec212fc8c61e202c51400afa7384d4bc
Modified: 2024-11-21
CVE-2017-8064
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
- DSA-3886
- DSA-3886
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.12
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.12
- [oss-security] 20170416 Silently (or obliviously) partially-fixed CONFIG_STRICT_DEVMEM bypass
- [oss-security] 20170416 Silently (or obliviously) partially-fixed CONFIG_STRICT_DEVMEM bypass
- 97975
- 97975
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=005145378c9ad7575a01b6ce1ba118fb427f583a
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=005145378c9ad7575a01b6ce1ba118fb427f583a
- https://github.com/torvalds/linux/commit/005145378c9ad7575a01b6ce1ba118fb427f583a
- https://github.com/torvalds/linux/commit/005145378c9ad7575a01b6ce1ba118fb427f583a
Modified: 2024-11-21
CVE-2017-8067
drivers/char/virtio_console.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.12
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.12
- [oss-security] 20170416 Silently (or obliviously) partially-fixed CONFIG_STRICT_DEVMEM bypass
- [oss-security] 20170416 Silently (or obliviously) partially-fixed CONFIG_STRICT_DEVMEM bypass
- 97997
- 97997
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c4baad50297d84bde1a7ad45e50c73adae4a2192
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c4baad50297d84bde1a7ad45e50c73adae4a2192
- https://github.com/torvalds/linux/commit/c4baad50297d84bde1a7ad45e50c73adae4a2192
- https://github.com/torvalds/linux/commit/c4baad50297d84bde1a7ad45e50c73adae4a2192
Package kernel-image-std-def updated to version 4.4.63-alt0.M80P.2 for branch p8 in task 182060.
Closed vulnerabilities
BDU:2017-01547
Уязвимость операционной системы Linux, позволяющая нарушителю считывать или записывать в ячейки памяти ядра
BDU:2017-01571
Уязвимость компонента crypto/ahash.c ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2017-7618
crypto/ahash.c in the Linux kernel through 4.10.9 allows attackers to cause a denial of service (API operation calling its own callback, and infinite recursion) by triggering EBUSY on a full queue.
- http://marc.info/?l=linux-crypto-vger&m=149181655623850&w=2
- http://marc.info/?l=linux-crypto-vger&m=149181655623850&w=2
- 97534
- 97534
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03800en_us
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03800en_us
Modified: 2024-11-21
CVE-2017-7889
The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file, related to arch/x86/mm/init.c and drivers/char/mem.c.
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a4866aa812518ed1a37d8ea0c881dc946409de94
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a4866aa812518ed1a37d8ea0c881dc946409de94
- DSA-3945
- DSA-3945
- http://www.openwall.com/lists/oss-security/2017/04/16/4
- http://www.openwall.com/lists/oss-security/2017/04/16/4
- 97690
- 97690
- RHSA-2017:1842
- RHSA-2017:1842
- RHSA-2017:2077
- RHSA-2017:2077
- RHSA-2017:2669
- RHSA-2017:2669
- RHSA-2018:1854
- RHSA-2018:1854
- https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=b8f254aa17f720053054c4ecff3920973a83b9d6
- https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=b8f254aa17f720053054c4ecff3920973a83b9d6
- https://github.com/torvalds/linux/commit/a4866aa812518ed1a37d8ea0c881dc946409de94
- https://github.com/torvalds/linux/commit/a4866aa812518ed1a37d8ea0c881dc946409de94
- USN-3583-1
- USN-3583-1
- USN-3583-2
- USN-3583-2