Home / mailings

PDF

[USN-1704-1] Linux kernel (Quantal HWE) vulnerabilities

Posted on 22 January 2013
Ubuntu Security

==========================
==========================
========================
Ubuntu Security Notice USN-1704-1
January 22, 2013

linux-lts-quantal - Linux kernel hardware enablement from Quantal vulnera=
bilities
==========================
==========================
========================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description:
- linux-lts-quantal: Linux kernel LTS from Quantal

Details:

Brad Spengler discovered a flaw in the Linux kernel's uname system call. =
An
unprivileged user could exploit this flaw to read kernel stack memory.
(CVE-2012-0957)

Jon Howell reported a flaw in the Linux kernel's KVM (Kernel-based virtua=
l
machine) subsystem's handling of the XSAVE feature. On hosts, using qemu
userspace, without the XSAVE feature an unprivileged local attacker could=

exploit this flaw to crash the system. (CVE-2012-4461)

Dmitry Monakhov reported a race condition flaw the Linux ext4 filesystem
that can expose stale data. An unprivileged user could exploit this flaw =
to
cause an information leak. (CVE-2012-4508)

A flaw was discovered in the Linux kernel's handling of script execution
when module loading is enabled. A local attacker could exploit this flaw =
to
cause a leak of kernel stack contents. (CVE-2012-4530)

Rodrigo Freire discovered a flaw in the Linux kernel's TCP illinois
congestion control algorithm. A local attacker could use this to cause a
denial of service. (CVE-2012-4565)

A flaw was discovered in the Linux kernel's handling of new hot-plugged
memory. An unprivileged local user could exploit this flaw to cause a
denial of service by crashing the system. (CVE-2012-5517)

Florian Weimer discovered that hypervkvpd, which is distributed in the
Linux kernel, was not correctly validating source addresses of netlink
packets. An untrusted local user can cause a denial of service by causing=

hypervkvpd to exit. (CVE-2012-5532)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
linux-image-3.5.0-22-generic 3.5.0-22.34~precise1

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1704-1
CVE-2012-0957, CVE-2012-4461, CVE-2012-4508, CVE-2012-4530,
CVE-2012-4565, CVE-2012-5517, CVE-2012-5532

Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-quantal/3.5.0-22.34~prec=
ise1


--------------090904000409020704000009
Content-Type: text/plain; charset=UTF-8;
name="Attached Message Part"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="Attached Message Part"


--------------090904000409020704000009--

------------

 

TOP