ALT-PU-2017-2604-1
Package kernel-image-un-def updated to version 4.13.12-alt1 for branch sisyphus in task 193468.
Closed vulnerabilities
BDU:2017-02559
Уязвимость ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2017-02561
Уязвимость функции cx231xx_usb_probe ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2017-02565
Уязвимость функции get_endpoints ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2018-00066
Уязвимость функции qmi_wwan_bind (drivers/net/usb/qmi_wwan.c) ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2018-00067
Уязвимость функции usbnet_generic_cdc_bind (drivers/net/usb/cdc_ether.c) ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2018-00068
Уязвимость функции dvb_frontend_free (drivers/media/dvb-core/dvb_frontend.c) ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2018-00069
Уязвимость функции asix_suspend (drivers/net/usb/asix_devices.c) ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2018-00070
Уязвимость функции ims_pcu_get_cdc_union_desc (drivers/input/misc/ims-pcu.c) ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2018-00071
Уязвимость функции hdpvr_probe (drivers/media/usb/hdpvr/hdpvr-core.c) ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
BDU:2018-00072
Уязвимость функции parse_hid_report_descriptor (drivers/input/tablet/gtco.c) ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
Modified: 2024-11-21
CVE-2017-15128
A flaw was found in the hugetlb_mcopy_atomic_pte function in mm/hugetlb.c in the Linux kernel before 4.13.12. A lack of size check could cause a denial of service (BUG).
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1e3921471354244f70fe268586ff94a97a6dd4df
- https://access.redhat.com/security/cve/CVE-2017-15128
- https://bugzilla.redhat.com/show_bug.cgi?id=1525222
- https://github.com/torvalds/linux/commit/1e3921471354244f70fe268586ff94a97a6dd4df
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.12
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1e3921471354244f70fe268586ff94a97a6dd4df
- https://access.redhat.com/security/cve/CVE-2017-15128
- https://bugzilla.redhat.com/show_bug.cgi?id=1525222
- https://github.com/torvalds/linux/commit/1e3921471354244f70fe268586ff94a97a6dd4df
- https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.12
Modified: 2025-04-20
CVE-2017-16532
The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.
- https://github.com/torvalds/linux/commit/7c80f9e4a588f1925b07134bb2e3689335f6c6d8
- https://groups.google.com/d/msg/syzkaller/l3870gs3LhA/y79DYQdFBAAJ
- https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html
- https://usn.ubuntu.com/3617-1/
- https://usn.ubuntu.com/3617-2/
- https://usn.ubuntu.com/3617-3/
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3754-1/
- https://github.com/torvalds/linux/commit/7c80f9e4a588f1925b07134bb2e3689335f6c6d8
- https://groups.google.com/d/msg/syzkaller/l3870gs3LhA/y79DYQdFBAAJ
- https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html
- https://usn.ubuntu.com/3617-1/
- https://usn.ubuntu.com/3617-2/
- https://usn.ubuntu.com/3617-3/
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3754-1/
Modified: 2025-04-20
CVE-2017-16536
The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.
- https://groups.google.com/d/msg/syzkaller/WlUAVfDvpRk/1V1xuEA4AgAJ
- https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html
- https://patchwork.kernel.org/patch/9963527/
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3754-1/
- https://groups.google.com/d/msg/syzkaller/WlUAVfDvpRk/1V1xuEA4AgAJ
- https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html
- https://patchwork.kernel.org/patch/9963527/
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3754-1/
Modified: 2025-04-20
CVE-2017-16538
drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device, related to a missing warm-start check and incorrect attach timing (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner).
- http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html
- https://groups.google.com/d/msg/syzkaller/XwNidsl4X04/ti6I2IaRBAAJ
- https://patchwork.linuxtv.org/patch/44566/
- https://patchwork.linuxtv.org/patch/44567/
- https://usn.ubuntu.com/3631-1/
- https://usn.ubuntu.com/3631-2/
- https://usn.ubuntu.com/3754-1/
- https://www.debian.org/security/2017/dsa-4073
- https://www.debian.org/security/2018/dsa-4082
- http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html
- https://groups.google.com/d/msg/syzkaller/XwNidsl4X04/ti6I2IaRBAAJ
- https://patchwork.linuxtv.org/patch/44566/
- https://patchwork.linuxtv.org/patch/44567/
- https://usn.ubuntu.com/3631-1/
- https://usn.ubuntu.com/3631-2/
- https://usn.ubuntu.com/3754-1/
- https://www.debian.org/security/2017/dsa-4073
- https://www.debian.org/security/2018/dsa-4082
Modified: 2025-04-20
CVE-2017-16643
The parse_hid_report_descriptor function in drivers/input/tablet/gtco.c in the Linux kernel before 4.13.11 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.11
- http://www.securityfocus.com/bid/101769
- https://github.com/torvalds/linux/commit/a50829479f58416a013a4ccca791336af3c584c7
- https://groups.google.com/d/msg/syzkaller/McWFcOsA47Y/3bjtBBgaBAAJ
- https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html
- https://usn.ubuntu.com/3754-1/
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.11
- http://www.securityfocus.com/bid/101769
- https://github.com/torvalds/linux/commit/a50829479f58416a013a4ccca791336af3c584c7
- https://groups.google.com/d/msg/syzkaller/McWFcOsA47Y/3bjtBBgaBAAJ
- https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html
- https://usn.ubuntu.com/3754-1/
Modified: 2025-04-20
CVE-2017-16644
The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (improper error handling and system crash) or possibly have unspecified other impact via a crafted USB device.
- http://www.securityfocus.com/bid/101842
- https://groups.google.com/d/msg/syzkaller/ngC5SLvxPm4/gduhCARhAwAJ
- https://patchwork.kernel.org/patch/9966135/
- https://usn.ubuntu.com/3754-1/
- https://www.debian.org/security/2017/dsa-4073
- http://www.securityfocus.com/bid/101842
- https://groups.google.com/d/msg/syzkaller/ngC5SLvxPm4/gduhCARhAwAJ
- https://patchwork.kernel.org/patch/9966135/
- https://usn.ubuntu.com/3754-1/
- https://www.debian.org/security/2017/dsa-4073
Modified: 2025-04-20
CVE-2017-16645
The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.
- http://www.securityfocus.com/bid/101768
- https://github.com/torvalds/linux/commit/ea04efee7635c9120d015dcdeeeb6988130cb67a
- https://groups.google.com/d/msg/syzkaller/q6jjr1OhqO8/WcA99AVFBAAJ
- https://usn.ubuntu.com/3617-1/
- https://usn.ubuntu.com/3617-2/
- https://usn.ubuntu.com/3617-3/
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3754-1/
- http://www.securityfocus.com/bid/101768
- https://github.com/torvalds/linux/commit/ea04efee7635c9120d015dcdeeeb6988130cb67a
- https://groups.google.com/d/msg/syzkaller/q6jjr1OhqO8/WcA99AVFBAAJ
- https://usn.ubuntu.com/3617-1/
- https://usn.ubuntu.com/3617-2/
- https://usn.ubuntu.com/3617-3/
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3754-1/
Modified: 2025-04-20
CVE-2017-16646
drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted USB device.
- http://www.securityfocus.com/bid/101846
- https://groups.google.com/d/msg/syzkaller/-d6ilzbVu_g/OBy8_62mAwAJ
- https://patchwork.linuxtv.org/patch/45291/
- https://usn.ubuntu.com/3617-1/
- https://usn.ubuntu.com/3617-2/
- https://usn.ubuntu.com/3617-3/
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- http://www.securityfocus.com/bid/101846
- https://groups.google.com/d/msg/syzkaller/-d6ilzbVu_g/OBy8_62mAwAJ
- https://patchwork.linuxtv.org/patch/45291/
- https://usn.ubuntu.com/3617-1/
- https://usn.ubuntu.com/3617-2/
- https://usn.ubuntu.com/3617-3/
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
Modified: 2025-04-20
CVE-2017-16647
drivers/net/usb/asix_devices.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.
- http://www.securityfocus.com/bid/101767
- https://groups.google.com/d/msg/syzkaller/_9a6pd-p_0E/OnmnplQuAgAJ
- https://patchwork.ozlabs.org/patch/834686/
- https://usn.ubuntu.com/3617-1/
- https://usn.ubuntu.com/3617-2/
- https://usn.ubuntu.com/3617-3/
- http://www.securityfocus.com/bid/101767
- https://groups.google.com/d/msg/syzkaller/_9a6pd-p_0E/OnmnplQuAgAJ
- https://patchwork.ozlabs.org/patch/834686/
- https://usn.ubuntu.com/3617-1/
- https://usn.ubuntu.com/3617-2/
- https://usn.ubuntu.com/3617-3/
Modified: 2025-04-20
CVE-2017-16648
The dvb_frontend_free function in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device. NOTE: the function was later renamed __dvb_frontend_free.
- http://www.securityfocus.com/bid/101758
- https://access.redhat.com/errata/RHSA-2018:2948
- https://groups.google.com/d/msg/syzkaller/0HJQqTm0G_g/T931ItskBAAJ
- https://patchwork.kernel.org/patch/10046189/
- http://www.securityfocus.com/bid/101758
- https://access.redhat.com/errata/RHSA-2018:2948
- https://groups.google.com/d/msg/syzkaller/0HJQqTm0G_g/T931ItskBAAJ
- https://patchwork.kernel.org/patch/10046189/
Modified: 2025-04-20
CVE-2017-16649
The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device.
- http://www.securityfocus.com/bid/101761
- https://groups.google.com/d/msg/syzkaller/0e0gmaX9R0g/9Me9JcY2BQAJ
- https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html
- https://patchwork.ozlabs.org/patch/834771/
- https://usn.ubuntu.com/3617-1/
- https://usn.ubuntu.com/3617-2/
- https://usn.ubuntu.com/3617-3/
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3822-1/
- https://usn.ubuntu.com/3822-2/
- http://www.securityfocus.com/bid/101761
- https://groups.google.com/d/msg/syzkaller/0e0gmaX9R0g/9Me9JcY2BQAJ
- https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html
- https://patchwork.ozlabs.org/patch/834771/
- https://usn.ubuntu.com/3617-1/
- https://usn.ubuntu.com/3617-2/
- https://usn.ubuntu.com/3617-3/
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3822-1/
- https://usn.ubuntu.com/3822-2/
Modified: 2025-04-20
CVE-2017-16650
The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device.
- http://www.securityfocus.com/bid/101791
- https://groups.google.com/d/msg/syzkaller/0e0gmaX9R0g/9Me9JcY2BQAJ
- https://patchwork.ozlabs.org/patch/834770/
- https://usn.ubuntu.com/3617-1/
- https://usn.ubuntu.com/3617-2/
- https://usn.ubuntu.com/3617-3/
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3754-1/
- http://www.securityfocus.com/bid/101791
- https://groups.google.com/d/msg/syzkaller/0e0gmaX9R0g/9Me9JcY2BQAJ
- https://patchwork.ozlabs.org/patch/834770/
- https://usn.ubuntu.com/3617-1/
- https://usn.ubuntu.com/3617-2/
- https://usn.ubuntu.com/3617-3/
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3754-1/