Security
Cracking Linux with the backspace key?
Anybody who has been paying attention to the net over the last week or so will certainly have noticed an abundance of articles with titles like "How to hack any Linux machine just using backspace". All this press does indeed highlight an important vulnerability, but it may not be the one that they think they are talking about.
The source of these reports is a
mildly
hype-ridden disclosure of a vulnerability in the GRUB2 bootloader by
Hector Marco and Ismael Ripoll. It seems that hitting the backspace
character at the GRUB2 username prompt enough times will trigger an integer
underflow, allowing a bypass of GRUB2's authentication stage. According to
the authors, this vulnerability, exploitable for denial-of-service,
information-disclosure, and code-execution attacks, "results in an
incalculable number of
affected devices.
" It is indeed a serious vulnerability in some
settings and it needs to be fixed. Unfortunately, some of the most
severely affected systems may also be the hardest to patch. But language
like the above leads reporters to write that any Linux system can be broken
into using the backspace key, which stretches the truth somewhat.
It is worth looking at what is required to actually exploit this vulnerability. The conditions are:
- An attacker must have physical access to the system's console to be
able to type the famous backspaces. In general, once an attacker can
actually put hands onto a target system, the game is already lost.
That is no excuse for a trivially exploited vulnerability in the
bootloader's authentication code, but it does add a bit of
perspective. Note that you may have physical access to the
Linux-based entertainment system in your airplane seat, but you almost
certainly lack access to the console.
- The attacker must be able to reach the bootloader's authentication
prompt. That generally means being able to force a running Linux
system to reboot so that the bootloader actually runs. If the system
is configured to allow unprivileged users to cause a reboot, then
complaints of "denial of service" are already moot; service can be
denied at any time. Of course, that can also be done by pulling the
plug since, as has already been noted, the attacker has physical
access to the system.
- The system must be running the GRUB2 bootloader. If it's an x86
system, chances are that it is indeed GRUB2 that is installed there.
Other architectures tend to use other bootloaders, though. Many of
the embedded systems that might be most at risk from this type of
vulnerability will thus not be running the vulnerable software.
- The bootloader must actually be configured for password-based access.
While lacking hard data, your editor would guess that a small minority
of systems booting with GRUB2 have passwords set on them. In most
cases, simply rebooting allows full access to the bootloader and its
capabilities — no exploit required.
- The system must be running an exploitable version of GRUB2. This part is relatively easy — the vulnerability has been present since version 1.98, released in late 2009.
Given the above, it seems unlikely that this vulnerability has exposed "any Linux system" to attack. Instead, it has exposed a small number of systems that are configured with bootloader security, but that also allow physical access to a console keyboard. For some of those systems, this vulnerability constitutes a true emergency. For most of us, though, there is no particular need to go into red alert.
There is a different vulnerability that has been exposed here, though, that is somewhat more severe. Anybody who reads the mainstream technical press now "knows" that any Linux system can be broken into by pressing a single key a few times. Linux security has been exposed as a laughable joke; how can anybody take such a system seriously?
In other words, all it takes is a couple of researchers who are able to turn up a bug, create a logo and a cute name ("Back to 28" in this case) for it, and post it as a "zero-day vulnerability" to create a storm of mocking bad publicity for Linux. Relative to, say, the Juniper firewall backdoor, disclosed at about the same time, the GRUB2 issue is minor indeed. But "28 backspaces" makes for good headlines, so it may well be that more people know about the GRUB2 vulnerability than the "unauthorized code" in security-critical Juniper products. It's bad enough when, as happens all too often, we are justly lambasted for security problems affecting large numbers of users; to be taken to task for this one is just kind of sad.
Arguably, we have just seen an exploit of a vulnerability in our public-relations system: any attacker with a "zero-day" bug and some minimal marketing skills can cause untold damage to the image of Linux as a whole. Companies deal with such issues by firing up their own PR machines, but Linux does not really have any such thing. So we are stuck trying to patch up our reputation after the fact, hoping that at least some members of the press will eventually figure out that, in fact, you really can't hack into any Linux system by hitting the backspace key.
Brief items
Security quotes of the week
They don't always get it right—the sad history of copyright law in the United States is an example of how they can get it badly wrong again and again—but at least they had a chance before the technologies become widely adopted.
That's just not true anymore. A new technology can go from zero to a hundred million users in a year or less. That's just too fast for the political or legal process. By the time they're asked to make rules, these technologies are well-entrenched in society.
Green: On the Juniper backdoor
Here's an interesting article from cryptographer Matthew Green on how the Juniper backdoor is the least interesting part of this whole episode. "Thus Dual EC is safe only if you assume no tiny bug in the code could accidentally leak out 30 bytes or so of raw Dual EC output. If it did, this would make all subsequent seeding calls predictable, and thus render all numbers generated by the system predictable. In general, this would spell doom for the confidentiality of VPN connections. And unbelievably, amazingly, who coulda thunk it, it appears that such a bug does exist in many versions of ScreenOS, dating to both before and after the 'unauthorized code' noted by Juniper."
New vulnerabilities
blueman: privilege escalation
| Package(s): | blueman | CVE #(s): | CVE-2015-8612 | ||||||||||||||||
| Created: | December 21, 2015 | Updated: | January 26, 2016 | ||||||||||||||||
| Description: | From the Debian advisory:
It was discovered that the Mechanism plugin of Blueman, a graphical Bluetooth manager, allows local privilege escalation. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
cacti: SQL injection
| Package(s): | cacti | CVE #(s): | CVE-2015-8369 | ||||||||||||||||||||||||||||||||||||||||
| Created: | December 17, 2015 | Updated: | January 4, 2016 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
Several SQL injection vulnerabilities have been discovered in Cacti, an RRDTool frontend written in PHP. Specially crafted input can be used by an attacker in the rra_id value of the graph.php script to execute arbitrary SQL commands on the database. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
chromium: code execution
| Package(s): | chromium-browser | CVE #(s): | CVE-2015-6792 | ||||||||||||||||||||||||
| Created: | December 18, 2015 | Updated: | December 23, 2015 | ||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
Two flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2015-6792) | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
claws-mail: code execution
| Package(s): | claws-mail | CVE #(s): | CVE-2015-8614 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 23, 2015 | Updated: | February 17, 2016 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
A remotely triggerable buffer overflow has been found in the code of claws-mail handling character conversion, in functions conv_jistoeuc(), conv_euctojis() and conv_sjistoeuc(), in codeconv.c. There was no bounds checking on buffers passed to these functions, some stack-based but other potentially heap-based. This issue has been located in the wild and might currently be exploited. A remote attacker might be able to execute arbitrary code on the affected host by sending a crafted e-mail to a claws-mail user. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
director: two vulnerabilities
| Package(s): | RHELOSP7 director | CVE #(s): | CVE-2015-5303 CVE-2015-5329 | ||||
| Created: | December 22, 2015 | Updated: | December 23, 2015 | ||||
| Description: | From the Red Hat advisory:
It was discovered that the director's NeutronMetadataProxySharedSecret parameter remained specified at the default value of 'unset'. This value is used by OpenStack Networking to sign instance headers; if unchanged, an attacker knowing the shared secret could use this flaw to spoof OpenStack Networking metadata requests. (CVE-2015-5303) A flaw was found in the director (openstack-tripleo-heat-templates) where the RabbitMQ credentials defaulted to guest/guest and supplied values in the configuration were not used. As a result, all deployed overclouds used the same credentials (guest/guest). A remote, non-authenticated attacker could use this flaw to access RabbitMQ services in the deployed cloud. (CVE-2015-5329) | ||||||
| Alerts: |
| ||||||
ipython: code execution
| Package(s): | ipython | CVE #(s): | CVE-2015-7337 | ||||
| Created: | December 18, 2015 | Updated: | December 23, 2015 | ||||
| Description: | From the Gentoo advisory:
A remote attacker could entice a user to open a specially crafted text file using IPython, possibly resulting in execution of arbitrary JavaScript with the privileges of the process. | ||||||
| Alerts: |
| ||||||
kernel: information disclosure
| Package(s): | kernel | CVE #(s): | CVE-2015-7885 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 17, 2015 | Updated: | December 23, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Ubuntu advisory:
It was discovered that the driver for Digi Neo and ClassicBoard devices did not properly initialize data structures. A local attacker could use this to obtain sensitive information from the kernel. (CVE-2015-7885) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: information disclosure
| Package(s): | kernel | CVE #(s): | CVE-2015-7884 | ||||||||||||||||||||||||||||||||
| Created: | December 17, 2015 | Updated: | December 23, 2015 | ||||||||||||||||||||||||||||||||
| Description: | From the Ubuntu advisory:
It was discovered that the virtual video osd test driver in the Linux kernel did not properly initialize data structures. A local attacker could use this to obtain sensitive information from the kernel. (CVE-2015-7884) | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
kernel: denial of service
| Package(s): | kernel | CVE #(s): | CVE-2015-8543 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 18, 2015 | Updated: | December 23, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
CVE-2015-8543: It was discovered that a local user permitted to create raw sockets could cause a denial-of-service by specifying an invalid protocol number for the socket. The attacker must have the CAP_NET_RAW capability in their user namespace. This has been fixed for the stable distribution (jessie) only. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: denial of service
| Package(s): | kernel | CVE #(s): | CVE-2015-8215 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 18, 2015 | Updated: | December 23, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the SUSE advisory:
CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel did not validate attempted changes to the MTU value, which allowed context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272. (bsc#955354) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: multiple vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2015-8550 CVE-2015-8551 CVE-2015-8552 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 21, 2015 | Updated: | December 23, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Ubuntu advisory:
Felix Wilhelm discovered a race condition in the Xen paravirtualized drivers which can cause double fetch vulnerabilities. An attacker in the paravirtualized guest could exploit this flaw to cause a denial of service (crash the host) or potentially execute arbitrary code on the host. (CVE-2015-8550) Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not perform sanity checks on the device's state. An attacker could exploit this flaw to cause a denial of service (NULL dereference) on the host. (CVE-2015-8551) Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not perform sanity checks on the device's state. An attacker could exploit this flaw to cause a denial of service by flooding the logging system with WARN() messages causing the initial domain to exhaust disk space. (CVE-2015-8552) Jann Horn discovered a ptrace issue with user namespaces in the Linux kernel. The namespace owner could potentially exploit this flaw by ptracing a root owned process entering the user namespace to elevate its privileges and potentially gain access outside of the namespace. (http://bugs.launchpad.net/bugs/1527374) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: denial of service
| Package(s): | kernel | CVE #(s): | CVE-2015-7550 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 22, 2015 | Updated: | February 23, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
A race between revoking a user-type key and reading from it was found, causing the kernel to crash. This race can be triggered by unprivileged user. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: denial of service
| Package(s): | kernel | CVE #(s): | CVE-2015-7509 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 22, 2015 | Updated: | December 23, 2015 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the SUSE advisory:
Mounting ext4 filesystems in no-journal mode could have lead to a system crash. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
libldb: remote memory disclosure
| Package(s): | libldb | CVE #(s): | CVE-2015-5330 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 18, 2015 | Updated: | December 23, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla entry:
It was reported that when adding an LDB DN to the database, that if a \00 (null byte) is used, remote memory can be read due to a combination of talloc_strdup() and a length assignment. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libpng: read underflow
| Package(s): | libpng | CVE #(s): | CVE-2015-8540 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 18, 2015 | Updated: | October 31, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the libpng bug report:
there is a underflow read in png_check_keyword in pngwutil.c in libpng-1.2.54. if the data of "key" is only ' ' (0x20), it will read a byte before the buffer in line 1288, | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
openstack-nova: insecure VM instances
| Package(s): | openstack-nova | CVE #(s): | CVE-2015-7713 | ||||||||||||||||
| Created: | December 22, 2015 | Updated: | December 23, 2015 | ||||||||||||||||
| Description: | From the Red Hat advisory:
A vulnerability was discovered in the way OpenStack Compute (nova) networking handled security group updates; changes were not applied to already running VM instances. A remote attacker could use this flaw to access running VM instances. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
python2-pyamf: denial of service
| Package(s): | python2-pyamf | CVE #(s): | CVE-2015-8549 | ||||
| Created: | December 18, 2015 | Updated: | December 23, 2015 | ||||
| Description: | From the Arch Linux advisory:
PyAMF suffers from insufficient AMF input payload sanitization which results in the XML parser not preventing the processing of XML external entities (XXE). A specially crafted AMF payload, containing malicious references to XML external entities, can be used to trigger denial of service (DoS) conditions or arbitrarily return the contents of files that are accessible with the running application privileges. A remote attacker is able to craft special XML files that, when processed, are injecting external entities resulting in denial of service of disclosure of arbitrary file contents. | ||||||
| Alerts: |
| ||||||
quassel: denial of service
| Package(s): | quassel | CVE #(s): | CVE-2015-8547 | ||||||||||||||||
| Created: | December 17, 2015 | Updated: | January 6, 2016 | ||||||||||||||||
| Description: | From the Mageia advisory:
The Quassel core could be crashed by a client using the op command, causing a denial of service (CVE-2015-8547). | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
ruby: code execution
| Package(s): | ruby | CVE #(s): | CVE-2015-7551 | ||||||||||||||||
| Created: | December 17, 2015 | Updated: | January 12, 2016 | ||||||||||||||||
| Description: | There is an unsafe tainted string vulnerability in Fiddle and DL. This
issue was originally reported and fixed with CVE-2009-5147 in DL, but
reappeared after DL was reimplemented using Fiddle and libffi.
A remote attacker is able to open a library via Fiddle with tainted library name if passed from an untrusted input. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
rubygem-passenger: environment variable injection
| Package(s): | rubygem-passenger | CVE #(s): | CVE-2015-7519 | ||||||||
| Created: | December 22, 2015 | Updated: | January 19, 2016 | ||||||||
| Description: | From the SUSE advisory:
rubygem-passenger was not filtering the environment like apache is doing, allowing injection of environment variables. | ||||||||||
| Alerts: |
| ||||||||||
samba: multiple vulnerabilities
| Package(s): | samba | CVE #(s): | CVE-2015-5299 CVE-2015-7540 CVE-2015-3223 CVE-2015-5252 CVE-2015-5296 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 18, 2015 | Updated: | January 4, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla entries:
CVE-2015-5299: Samba: Missing access control check in shadow copy code CVE-2015-7540: samba: DoS to AD-DC due to insufficient checking of asn1 memory allocation CVE-2015-3223: samba: Remote DoS in Samba (AD) LDAP server CVE-2015-5252: samba: Insufficient symlink verification in smbd CVE-2015-5296: samba: Samba client requesting encryption vulnerable to downgrade attack. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
sosreport: two vulnerabilities
| Package(s): | sosreport | CVE #(s): | CVE-2014-3925 CVE-2015-7529 | ||||||||||||||||||||||||||||||||||||||||
| Created: | December 18, 2015 | Updated: | February 17, 2016 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Ubuntu advisory:
Dolev Farhi discovered an information disclosure issue in SoS. If the /etc/fstab file contained passwords, the passwords were included in the SoS report. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-3925) Mateusz Guzik discovered that SoS incorrectly handled temporary files. A local attacker could possibly use this issue to overwrite arbitrary files or gain access to temporary file contents containing sensitive system information. (CVE-2015-7529) | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
subversion: code execution
| Package(s): | subversion | CVE #(s): | CVE-2015-5343 | ||||||||||||||||||||||||||||
| Created: | December 17, 2015 | Updated: | April 6, 2016 | ||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
Ivan Zhakov discovered an integer overflow in mod_dav_svn, which allows an attacker with write access to the server to execute arbitrary code or cause a denial of service. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
subversion: code execution
| Package(s): | subversion | CVE #(s): | CVE-2015-5259 | ||||||||||||
| Created: | December 23, 2015 | Updated: | December 23, 2015 | ||||||||||||
| Description: | From the Red Hat bugzilla:
Subversion servers and clients are vulnerable to a remotely triggerable heap-based buffer overflow and out-of-bounds read caused by an integer overflow in the svn:// protocol parser. This allows remote attackers to cause a denial of service or possibly execute arbitrary code under the context of the targeted process. | ||||||||||||||
| Alerts: |
| ||||||||||||||
tryton-server: access check bypass
| Package(s): | tryton-server | CVE #(s): | CVE-2015-0861 | ||||
| Created: | December 17, 2015 | Updated: | December 23, 2015 | ||||
| Description: | From the Debian advisory:
Cédric Krier discovered a vulnerability in the server-side of Tryton, an application framework written in Python. An aunthenticated malicious user can write arbitrary values in record fields due missed checks of access permissions when multiple records are written. | ||||||
| Alerts: |
| ||||||
xen: multiple vulnerabilities
| Package(s): | xen | CVE #(s): | CVE-2015-8338 CVE-2015-8339 CVE-2015-8340 CVE-2015-8341 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 17, 2015 | Updated: | December 23, 2015 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Fedora advisory:
Bug #1285350 - xen: Virtual Performance Measurement Unit feature is unsupported https://bugzilla.redhat.com/show_bug.cgi?id=1285350 Bug #1284933 - CVE-2015-8341 xen: libxl leak of PV kernel can cause OOM condition https://bugzilla.redhat.com/show_bug.cgi?id=1284933 Bug #1284919 - CVE-2015-8339 CVE-2015-8340 xen: XENMEM_exchange error handling may cause DoS to host https://bugzilla.redhat.com/show_bug.cgi?id=1284919 Bug #1284911 - CVE-2015-8338 xen: Long running memory operations on ARM cause DoS https://bugzilla.redhat.com/show_bug.cgi?id=1284911 | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
xen: two vulnerabilities
| Package(s): | xen | CVE #(s): | CVE-2015-8554 CVE-2015-8555 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 23, 2015 | Updated: | December 23, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
1289129: "qemu-xen-traditional" (aka qemu-dm) tracks state for each MSI-X table entry of a passed through device. This is used/updated on (intercepted) accesses to the page(s) containing the MSI-X table. There may be space on the final page not covered by any MSI-X table entry, but memory for state tracking is allocated only for existing table entries. Therefore bounds checks are required to avoid accessing/corrupting unrelated heap memory. Such a check is present for the read path, but was missing for the write path. A malicious administrator of a guest which has access to a passed through PCI device which is MSI-X capable can exploit this vulnerability to take over the qemu process, elevating its privilege to that of the qemu process. In a system not using a device model stub domain (or other techniques for deprivileging qemu), the malicious guest administrator can thus elevate their privilege to that of the host. (CVE-2015-8554) 1289130: When XSAVE/XRSTOR are not in use by Xen to manage guest extended register state, the initial values in the FPU stack and XMM registers seen by the guest upon first use are those left there by the previous user of those registers. A malicious domain may be able to leverage this to obtain sensitive information such as cryptographic keys from another domain. (CVE-2015-8555) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
xsupplicant: insecure temporary files
| Package(s): | xsupplicant | CVE #(s): | |||||||||
| Created: | December 21, 2015 | Updated: | December 23, 2015 | ||||||||
| Description: | From the Red Hat bugzilla:
It was found that xsupplicant uses hardcoded fixed temporary file for sockets, storing into /tmp/xsupplicant.sock.$INTERFACE. | ||||||||||
| Alerts: |
| ||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>