From the Ubuntu advisory:
Dave Jones discovered that the gdth SCSI driver did not correctly validate
array indexes in certain ioctl calls. A local attacker could exploit
this to crash the system or gain elevated privileges. (CVE-2009-3080)
J. Bruce Fields discovered that NFSv4 did not correctly use the credential
cache. A local attacker using a mount with AUTH_NULL authentication
could exploit this to crash the system or gain root privileges. Only
Ubuntu 9.10 was affected. (CVE-2009-3623)
Alexander Zangerl discovered that the kernel keyring did not correctly
reference count. A local attacker could issue a series of specially
crafted keyring calls to crash the system or gain root privileges.
Only Ubuntu 9.10 was affected. (CVE-2009-3624)
Avi Kivity discovered that KVM did not correctly check privileges when
accessing debug registers. A local attacker could exploit this to
crash a host system from within a guest system, leading to a denial of
service. Ubuntu 6.06 and 9.10 were not affected. (CVE-2009-3722)
Philip Reisner discovered that the connector layer for uvesafb, pohmelfs,
dst, and dm did not correctly check capabilties. A local attacker could
exploit this to crash the system or gain elevated privileges. Ubuntu
6.06 was not affected. (CVE-2009-3725)
Robin Getz discovered that NOMMU systems did not correctly validate
NULL pointers in do_mmap_pgoff calls. A local attacker could attempt to
allocate large amounts of memory to crash the system, leading to a denial
of service. Only Ubuntu 6.06 and 9.10 were affected. (CVE-2009-3888)
Roel Kluin discovered that the Hisax ISDN driver did not correctly
check the size of packets. A remote attacker could send specially
crafted packets to cause a system crash, leading to a denial of
service. (CVE-2009-4005)
Lennert Buytenhek discovered that certain 802.11 states were not handled
correctly. A physically-proximate remote attacker could send specially
crafted wireless traffic that would crash the system, leading to a denial
of service. Only Ubuntu 9.10 was affected. (CVE-2009-4026, CVE-2009-4027)
| 