Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4487 > unrolled thread

Re: [SECURITY] [DSA 3448-1] linux security update

Started byBjoern Nyjorden <brn@iinet.net.au>
First post2016-01-20 02:40 +0100
Last post2016-01-20 10:30 +0100
Articles 5 — 3 participants

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [SECURITY] [DSA 3448-1] linux security update Bjoern Nyjorden <brn@iinet.net.au> - 2016-01-20 02:40 +0100
    Re: [SECURITY] [DSA 3448-1] linux security update Holger Levsen <holger@layer-acht.org> - 2016-01-20 03:00 +0100
      Re: [SECURITY] [DSA 3448-1] linux security update Bjoern Nyjorden <brn@iinet.net.au> - 2016-01-20 04:10 +0100
        Re: [SECURITY] [DSA 3448-1] linux security update Salvatore Bonaccorso <carnil@debian.org> - 2016-01-20 06:30 +0100
        Re: [SECURITY] [DSA 3448-1] linux security update Holger Levsen <holger@layer-acht.org> - 2016-01-20 10:30 +0100

#4487 — Re: [SECURITY] [DSA 3448-1] linux security update

FromBjoern Nyjorden <brn@iinet.net.au>
Date2016-01-20 02:40 +0100
SubjectRe: [SECURITY] [DSA 3448-1] linux security update
Message-ID<qSPUE-7Iz-67@gated-at.bofh.it>
Hi again,

Are the "Wheezy" Linux kernels affected as well, or are they currently 
okay as far as you know?

Many thanks in advance, and kindest regards,
Bjoern.

On 19/01/16 20:40, Salvatore Bonaccorso wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> - -------------------------------------------------------------------------
> Debian Security Advisory DSA-3448-1                   security@debian.org
> https://www.debian.org/security/                     Salvatore Bonaccorso
> January 19, 2016                      https://www.debian.org/security/faq
> - -------------------------------------------------------------------------
>
> Package        : linux
> CVE ID         : CVE-2013-4312 CVE-2015-7566 CVE-2015-8767 CVE-2016-0723
>                   CVE-2016-0728
>
> Several vulnerabilities have been discovered in the Linux kernel that
> may lead to a privilege escalation or denial-of-service.
>
> CVE-2013-4312
>
>      Tetsuo Handa discovered that it is possible for a process to open
>      far more files than the process' limit leading to denial-of-service
>      conditions.
>
> CVE-2015-7566
>
>      Ralf Spenneberg of OpenSource Security reported that the visor
>      driver crashes when a specially crafted USB device without bulk-out
>      endpoint is detected.
>
> CVE-2015-8767
>
>      An SCTP denial-of-service was discovered which can be triggered by a
>      local attacker during a heartbeat timeout event after the 4-way
>      handshake.
>
> CVE-2016-0723
>
>      A use-after-free vulnerability was discovered in the TIOCGETD ioctl.
>      A local attacker could use this flaw for denial-of-service.
>
> CVE-2016-0728
>
>      The Perception Point research team discovered a use-after-free
>      vulnerability in the keyring facility, possibly leading to local
>      privilege escalation.
>
> For the stable distribution (jessie), these problems have been fixed in
> version 3.16.7-ckt20-1+deb8u3.
>
> We recommend that you upgrade your linux packages.
>
> Further information about Debian Security Advisories, how to apply
> these updates to your system and frequently asked questions can be
> found at: https://www.debian.org/security/
>
> Mailing list: debian-security-announce@lists.debian.org
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQIcBAEBCgAGBQJWni1mAAoJEAVMuPMTQ89EYvkP/Rmqrwxv1M+z4qj3OmfF81Q+
> zj5Kd9nrvolH/asFac3URBHurSQby3JRgwxtqJuTrc68xBn147CQWaDM5nU9/HBi
> Dt3eceDxsGBo9W8FJEpE6Yk4a3NyNiEOnT7gLFfSjFkmyGr3a6+7b1VPAEcsDeBV
> FbA40UhrDnZYoeqqBFOGqedzFBioSafd+AQOYNqCjNByNq5i3SxMgS3XCECrruUr
> yGfR+0RD5EibvcUddzduuGOvjmaW+mPK6OTVir2f6AwJFdSOJEegkSZRkLeBJgYL
> Lfk131dlJ6gwelAaGOJA9wAqSPVIFe9h+jFh2DTQ6q5Lrg5dchkibbb2eSuoqRO1
> Fa1cXW33k8YSilTzvy7pO1Snrp2YhGKK3RPo5PNAsdmOiuzSkI9PUw+khz/TtJ9N
> XSKmOGd3ZT3R81UuEiXTdJVzVsRS+jLpgQ2jjOlvDb5ldQgn9tirL36/isSRcM64
> IGnJlLHxhzBv+GQyziVDy37ois2dYT3in6ls2tI7rHoYhaEyOwPyCn98/IJqPxea
> SIeLGxStaaCGqgDaFqCJbRuAZGFqpwZLKSd9/HycA7jTJbfrdzD74eDFc8LvGYly
> Il1vpT8Ekfxh9L4o+HkzVkme7dkYt5SmLGvN1euTUdjsuo87r3OwN0OKVhXrFoAV
> qaetOmH+fJB1/jo9jPLH
> =fylF
> -----END PGP SIGNATURE-----
>

[toc] | [next] | [standalone]

#4488

FromHolger Levsen <holger@layer-acht.org>
Date2016-01-20 03:00 +0100
Message-ID<qSQdY-7Ro-5@gated-at.bofh.it>
In reply to#4487

[Multipart message — attachments visible in raw view] — view raw

Hi Bjoern (bcc:ed),

On Mittwoch, 20. Januar 2016, Bjoern Nyjorden wrote:
> Are the "Wheezy" Linux kernels affected as well, or are they currently
> okay as far as you know?

on debian-backports@l.d.o Ben wrote:

> [...]  It's fixed in jessie and sid,
> and doesn't affect anything older.  {wheezy,jessie}-backports will be
> fixed soon.

Thanks Ben!


cheers,
	Holger

[toc] | [prev] | [next] | [standalone]

#4489

FromBjoern Nyjorden <brn@iinet.net.au>
Date2016-01-20 04:10 +0100
Message-ID<qSRjI-pN-51@gated-at.bofh.it>
In reply to#4488
Thanks Holger & Ben,

Most appreciated.  So, just to confirm; my take away on this is:

  * 1. "Wheezy" Linux kernels are NOT AFFECTED.

  * 2. "Wheezy" & "Jessie" BACKPORTS Linux kernels are VUNERABLE.

If I have understood correctly?

Kindest regards,
Bjoern.

On 20/01/16 09:49, Holger Levsen wrote:
> Hi Bjoern (bcc:ed),
>
> On Mittwoch, 20. Januar 2016, Bjoern Nyjorden wrote:
>
>  > Are the "Wheezy" Linux kernels affected as well, or are they currently
>
>  > okay as far as you know?
>
> on debian-backports@l.d.o Ben wrote:
>
>  > [...] It's fixed in jessie and sid,
>
>  > and doesn't affect anything older. {wheezy,jessie}-backports will be
>
>  > fixed soon.
>
> Thanks Ben!
>
> cheers,
>
> Holger
>

[toc] | [prev] | [next] | [standalone]

#4490

FromSalvatore Bonaccorso <carnil@debian.org>
Date2016-01-20 06:30 +0100
Message-ID<qSTvc-1X3-9@gated-at.bofh.it>
In reply to#4489
Hi,

On Wed, Jan 20, 2016 at 10:42:04AM +0800, Bjoern Nyjorden wrote:
> Thanks Holger & Ben,
> 
> Most appreciated.  So, just to confirm; my take away on this is:
> 
>  * 1. "Wheezy" Linux kernels are NOT AFFECTED.
> 
>  * 2. "Wheezy" & "Jessie" BACKPORTS Linux kernels are VUNERABLE.
> 
> If I have understood correctly?

For the most important CVE,
https://security-tracker.debian.org/tracker/CVE-2016-0728 this is
right. The issue was introduced in upstream commit
3a50597de8635cd05133bd12c95681c82fe7b878 which is in Kernels v3.8-rc1
onways. Wheezy Kernel is not affected, Wheezy and Jessie backports are
vunerable but beeing fixed.

You can get the full picture for Wheezy and Jessie status by starting
from https://security-tracker.debian.org/tracker/DSA-3448-1 and
following the CVE references for details. The other issues which
affect Wheezy as well will be fixed for Wheezy in a later DSA.

(yes, the security-tracker does not track backports).

Hope this helps,

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#4491

FromHolger Levsen <holger@layer-acht.org>
Date2016-01-20 10:30 +0100
Message-ID<qSXft-4qR-23@gated-at.bofh.it>
In reply to#4489

[Multipart message — attachments visible in raw view] — view raw

Hi,

On Mittwoch, 20. Januar 2016, Bjoern Nyjorden wrote:
> Most appreciated.  So, just to confirm; my take away on this is:
> 
>   * 1. "Wheezy" Linux kernels are NOT AFFECTED.
> 
>   * 2. "Wheezy" & "Jessie" BACKPORTS Linux kernels are VUNERABLE.
> 
> If I have understood correctly?

yes!


cheers,
	Holger

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web