Home / mailings [USN-1704-2] Linux kernel (Quantal HWE) regression
Posted on 01 February 2013
Ubuntu Security==========================
==========================
========================
Ubuntu Security Notice USN-1704-2
February 01, 2013
linux-lts-quantal - Linux kernel hardware enablement from Quantal regress=
ion
==========================
==========================
========================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
USN-1704-1 introduced a regression in the Linux kernel.
Software Description:
- linux-lts-quantal: Linux hardware enablement kernel from Quantal
Details:
USN-1704-1 fixed vulnerabilities in the Linux kernel. Due to an unrelated=
regression inotify/fanotify stopped working after upgrading. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Brad Spengler discovered a flaw in the Linux kernel's uname system call.=
An
unprivileged user could exploit this flaw to read kernel stack memory.
(CVE-2012-0957)
=20
Jon Howell reported a flaw in the Linux kernel's KVM (Kernel-based virtu=
al
machine) subsystem's handling of the XSAVE feature. On hosts, using qemu=
userspace, without the XSAVE feature an unprivileged local attacker coul=
d
exploit this flaw to crash the system. (CVE-2012-4461)
=20
Dmitry Monakhov reported a race condition flaw the Linux ext4 filesystem=
that can expose stale data. An unprivileged user could exploit this flaw=
to
cause an information leak. (CVE-2012-4508)
=20
A flaw was discovered in the Linux kernel's handling of script execution=
when module loading is enabled. A local attacker could exploit this flaw=
to
cause a leak of kernel stack contents. (CVE-2012-4530)
=20
Rodrigo Freire discovered a flaw in the Linux kernel's TCP illinois
congestion control algorithm. A local attacker could use this to cause a=
denial of service. (CVE-2012-4565)
=20
A flaw was discovered in the Linux kernel's handling of new hot-plugged
memory. An unprivileged local user could exploit this flaw to cause a
denial of service by crashing the system. (CVE-2012-5517)
=20
Florian Weimer discovered that hypervkvpd, which is distributed in the
Linux kernel, was not correctly validating source addresses of netlink
packets. An untrusted local user can cause a denial of service by causin=
g
hypervkvpd to exit. (CVE-2012-5532)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
linux-image-3.5.0-23-generic 3.5.0-23.35~precise1
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic=
,
linux-server, linux-powerpc), a standard system upgrade will automaticall=
y
perform this as well.
References:
http://www.ubuntu.com/usn/usn-1704-2
http://www.ubuntu.com/usn/usn-1704-1
https://launchpad.net/bugs/1101666
Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-quantal/3.5.0-23.35~prec=
ise1
--------------070203090705040405090406
Content-Type: text/plain; charset=UTF-8;
name="Attached Message Part"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="Attached Message Part"
--------------070203090705040405090406--
------------
