Security
Sandboxing with the Landlock security module
Anybody working to harden a computing system is likely to look at sandboxing fairly early in the process. The prospect of vulnerabilities in running software is a bit less worrisome if the scope for exploitation of those vulnerabilities is limited, and a sandbox can limit an attacker's freedom nicely. The kernel has a number of mechanisms that can support sandboxing now, and others are under development. One of those, the Landlock security module, was the topic of Mickaël Salaün's talk at Kernel Recipes 2016.The goal for Landlock, Salaün said, is to allow unprivileged users to restrict processes that they run. He is trying to create something that is similar to the OpenBSD pledge() (formerly tame()) system call. By restricting what a running process can do, a Landlock-based sandbox can reduce the attack surface of the kernel and, with luck, make the exploitation of vulnerabilities harder in general.
Why not use the mechanisms that the kernel already provides? The
Linux security module (LSM) subsystem offers mechanisms like SELinux or
Smack, but those are meant for administrators, not users, Salaün said.
Their configuration is complex, and setting policies is a privileged
operation, which runs counter to the goal of working for unprivileged
users. The seccomp() mechanism can be used to create sandboxes,
but it is limited; only 64 bits of information can be passed to a
seccomp() hook, and it is not possible to filter system calls
![[Mickaël Salaün]](https://static.lwn.net/images/conf/2016/recipes/MickaëlSalaün-sm.jpg "Mickaël Salaün")
based on the paths of files they try to access. The system-call level is
also the wrong place for this kind of filtering; the security hooks used by
the LSM subsystem are better placed for making proper access-control
decisions.
Thus, a new LSM. It can be thought of as being similar to seccomp(), in that it allows the loading of BPF programs to make access-control decisions. There are two aspects to that functionality that are of interest.
The first is the ability to attach BPF programs directly to the LSM hook functions and to give them access to the arguments passed to the hooks. In the current form of the patch set, the security_file_open(), security_file_permission(), and security_mmap_file() hooks can have programs attached to them; there are plans to add more hooks in the future.
These hooks need the ability to make access-control decisions; in particular, Salaün is looking for the ability to make path-based decisions. So, for example, a program might be blocked from accessing any files outside of a dedicated, application-specific directory. To support this type of decision-making, a new type of BPF map (BPF_MAP_TYPE_LANDLOCK_ARRAY) is added. These maps can hold kernel pointers with an associated type; the actual use is to hold pointers to file structures. Then, there is a set of new BPF-callable utility functions with convenient names like bpf_landlock_cmp_fs_beneath_with_struct_file() that can tell a BPF program whether one file structure is beneath another in the filesystem hierarchy.
With that supporting structure in place, one can see how a Landlock-based sandbox would work. The control program populates a special map with the file descriptors (converted to file structures internally) of the directories that the sandboxed program is to be allowed to access. A simple BPF program, which is attached to the security hooks that are called when files are opened, can then ensure that any file-access attempt is located in or below one of the directories stored in the map. Confining a process to specific parts of the filesystem thus becomes relatively easy.
The last remaining piece is causing the relevant BPF programs to be run for the process(es) in the sandbox. There are two different ways in which that can be done:
- There is a new seccomp() operation, called
SECCOMP_SET_LANDLOCK_HOOK, which will cause a program to be
attached to a specific LSM hook for the current process. It is
possible to request that the program be invoked every time the
equivalent LSM hook is called, but there is another possibility as
well. A normal seccomp() program can be attached to one or
more system calls as usual, and Landlock can be told to only run the
LSM-attached program if the seccomp() program returns the
special SECCOMP_RET_LANDLOCK value. The seccomp()
program can, thus, make the access-control decision by itself, or it
can decide to defer to the Landlock program(s) that will be invoked
later.
- Landlock programs can be attached to a control group, using an extension to the bpf_prog_attach() patch. In this case, every process running within that control group will be regulated by the Landlock programs.
It is worth noting that the Landlock BPF programs are stackable in either context; if multiple layers of programs are attached, each will run in order and each will have the ability to veto any given operation.
Salaün demonstrated a simple program that uses the Landlock hooks. One need simply set the environment variable LANDLOCK_ALLOWED to a list of directories that a program should be allowed to access, then use the example program to launch the program of interest. The sandboxed program will be unable to access anything outside of the given list. Attempts to access forbidden files are turned back with an EPERM error; unlike seccomp(), Landlock does not kill programs that run into access restrictions.
The response to the module thus far has been mostly positive. Andy Lutomirski is concerned about the control-group mode, though, given that there are still outstanding questions about how the version-2 control-group interface is going to work in general. So he recommends leaving that piece out and just using seccomp() until that issue has been resolved. The control-group hook is a tiny piece of the whole, so, if leaving it out is the price of admission for now, it is hard to imagine that anybody will be too upset.
One other potential problem is that there is a competing proposal out there in the form of the Checmate module. From all appearances, though, Landlock is further along and more actively developed. It may make sense to take ideas from both projects, though; Checmate is more focused on networking operations at the moment, which is an area that Landlock has yet to address. So the details are yet to be determined, but it seems likely that there will be some sort of BPF-based security module in the kernel before too long. It has taken a while for the stackable security modules concept to bring about a new set of interesting security mechanisms, but that would appear to be happening at last.
[Your editor would like to thank Kernel Recipes for supporting his travel to the event.]
Brief items
Security quotes of the week
We don’t care, our payments are handled by a 3rd party payment providerIf someone can inject Javascript into your site, your database is most likely also hacked.
Thanks for your suggestion, but our shop is totally safe. There is just an annoying javascript error.Or, even better:
Our shop is safe because we use https
As I say often, cybersecurity is perhaps the most difficult intellectual occupation on the planet. Note that I said "occupation" rather than "profession." Three Septembers ago, the U.S. National Academy of Sciences concluded that cyber security should be seen as an occupation and not a profession because the rate of change is simply too great to consider professionalization. Ray Kurzweil is beyond all doubt correct; within the career lifetime of nearly everyone in this room, algorithms will be smarter than we are, and they will therefore be called upon to do what we cannot -- to protect us from other algorithms, and to ask no permission in so doing. Do we, like Ulysses, lash ourselves to the mast or do we, as the some would say, relax and enjoy the inevitable? What would we have science do? What are the possible futures you will tolerate? What horses do you want not let out of the barn? Where do we put our intelligence budget? US CYBERCOM's budget is $500 million, JPMorganChase, alone, is spending $600 million. Is that surprising or is that as it should be?
Secure Your Containers with this One Weird Trick (RHEL Blog)
Over on the Red Hat Enterprise Linux Blog, Dan Walsh writes about using Linux capabilities to help secure Docker containers. "Let’s look at the default list of capabilities available to privileged processes in a docker container: chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap. In the OCI/runc spec they are even more drastic only retaining, audit_write, kill, and net_bind_service and users can use ocitools to add additional capabilities. As you can imagine, I like the approach of adding capabilities you need rather than having to remember to remove capabilities you don’t." He then goes through the capabilities listed describing what they govern and when they might need to be turned on for a container application.
New vulnerabilities
asterisk: denial of service
| Package(s): | asterisk | CVE #(s): | |||||
| Created: | October 19, 2016 | Updated: | October 19, 2016 | ||||
| Description: | From the Mageia advisory:
The overlap dialing feature in chan_sip allows chan_sip to report to a device that the number that has been dialed is incomplete and more digits are required. If this functionality is used with a device that has performed username/password authentication RTP resources are leaked. This occurs because the code fails to release the old RTP resources before allocating new ones in this scenario. If all resources are used then RTP port exhaustion will occur and no RTP sessions are able to be set up (AST-2016-007). | ||||||
| Alerts: |
| ||||||
atomic-openshift: authentication bypass
| Package(s): | atomic-openshift | CVE #(s): | CVE-2016-7075 | ||||
| Created: | October 18, 2016 | Updated: | October 19, 2016 | ||||
| Description: | From the Red Hat advisory:
It was found that Kubernetes did not correctly validate X.509 client intermediate certificate host name fields. An attacker could use this flaw to bypass authentication requirements by using a specially crafted X.509 certificate. | ||||||
| Alerts: |
| ||||||
chromium-browser: multiple vulnerabilities
| Package(s): | chromium-browser | CVE #(s): | CVE-2016-5181 CVE-2016-5182 CVE-2016-5183 CVE-2016-5184 CVE-2016-5185 CVE-2016-5186 CVE-2016-5187 CVE-2016-5188 CVE-2016-5189 CVE-2016-5190 CVE-2016-5191 CVE-2016-5192 CVE-2016-5193 CVE-2016-5194 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 17, 2016 | Updated: | November 2, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-5181, CVE-2016-5182, CVE-2016-5183, CVE-2016-5184, CVE-2016-5185, CVE-2016-5187, CVE-2016-5194, CVE-2016-5186, CVE-2016-5188, CVE-2016-5189, CVE-2016-5190, CVE-2016-5191, CVE-2016-5192, CVE-2016-5193) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
dbus: code execution
| Package(s): | dbus | CVE #(s): | |||||||||||||
| Created: | October 14, 2016 | Updated: | November 10, 2016 | ||||||||||||
| Description: | From the Red Hat bugzilla:
A format string vulnerability in the reference bus implementation, dbus-daemon, could potentially allow local users to cause arbitrary code execution or denial of service. | ||||||||||||||
| Alerts: |
| ||||||||||||||
derby: information leak
| Package(s): | derby | CVE #(s): | CVE-2015-1832 | ||||||||
| Created: | October 14, 2016 | Updated: | November 18, 2016 | ||||||||
| Description: | From the openSUSE bug report:
Apache Derby could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML datatype and XmlVTI. An attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of service. | ||||||||||
| Alerts: |
| ||||||||||
dwarfutils: three vulnerabilities
| Package(s): | dwarfutils | CVE #(s): | CVE-2015-8538 CVE-2016-2050 CVE-2016-2091 | ||||
| Created: | October 19, 2016 | Updated: | October 19, 2016 | ||||
| Description: | From the Debian LTS advisory:
CVE-2015-8538: A specially crafted ELF file can cause a segmentation fault. CVE-2016-2050: Out-of-bounds write CVE-2016-2091: Out-of-bounds read | ||||||
| Alerts: |
| ||||||
epiphany: unspecified
| Package(s): | epiphany webkitgtk4 | CVE #(s): | |||||||||
| Created: | October 19, 2016 | Updated: | October 19, 2016 | ||||||||
| Description: | From the Fedora advisory:
Update WebKitGTK+ package to 2.14.1. Major changes in 2.14.0: * Threaded compositor is enabled by default in both X11 and Wayland. * Accelerated compositing is now supported in Wayland. * Clipboard works in Wayland too. * Memory pressure handler always works even when cgroups is not present or not configured. * The HTTP disk cache implements speculative revalidation of resources. * DRI3 is no longer a problem when using the modesetting intel driver. * The amount of file descriptors that are kept open has been drastically reduced. Fixes from 2.14.1: * MiniBrowser and jsc binaries are now installed in pkglibexecdir instead of bindir. * Improve performance when resizing a window with multiple web views in X11. * Check whether GDK can use GL before using gdk_cairo_draw_from_gl() in Wayland. * Updated default UserAgent string or better compatibility. * Fix a crash on github.com in IntlDateTimeFormat::resolvedOptions when using the C locale. * Fix BadDamage X errors when closing the web view in X11. * Fix UIProcess crash when using Japanese input method. * Fix build with clang due to missing header includes. * Fix the build with USE_REDIRECTED_XCOMPOSITE_WINDOW disabled. * Fix several crashes and rendering issues. * Translation updates: German. Update Epiphany to be compatible with the new WebKitGTK+ package. | ||||||||||
| Alerts: |
| ||||||||||
ffmpeg: multiple vulnerabilities
| Package(s): | ffmpeg | CVE #(s): | CVE-2016-7502 CVE-2016-7555 CVE-2016-7562 CVE-2016-7785 CVE-2016-7905 | ||||||||||||
| Created: | October 18, 2016 | Updated: | January 30, 2017 | ||||||||||||
| Description: | From the openSUSE advisory:
- CVE-2016-7562: out-of-bounds array write fault via specially crafted avi files - CVE-2016-7502: out-of-bounds array write via incorrect block values - CVE-2016-7905: null-point-exception when decoding avi files with crafted 'gab2' structs - CVE-2016-7555: memory leak when decoding avi files with crafted 'strh' struct - CVE-2016-7785: assert fault via avi files with crafted 'strh' struct | ||||||||||||||
| Alerts: |
| ||||||||||||||
guile: two vulnerabilities
| Package(s): | guile | CVE #(s): | CVE-2016-8605 CVE-2016-8606 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 17, 2016 | Updated: | February 17, 2017 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
- CVE-2016-8605 (information disclosure): The mkdir procedure of GNU Guile, an implementation of the Scheme programming language, temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. - CVE-2016-8606 (arbitrary code execution): It was reported that the REPL server is vulnerable to the HTTP inter- protocol attack. This constitutes a remote code execution vulnerability for developers running a REPL server that listens on a loopback device or private network. Applications that do not run a REPL server, as is usually the case, are unaffected. A remote attacker is able to execute arbitrary code via a HTTP inter-protocol attack if the REPL server is listening on a loopback device or private network. Running a multi-threaded guile application can cause directories or files to be created with world readable/writable/executable permissions during a small window which leads to information disclosure. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
java-1.8.0-openjdk: multiple vulnerabilities
| Package(s): | java-1.8.0-openjdk | CVE #(s): | CVE-2016-5542 CVE-2016-5554 CVE-2016-5573 CVE-2016-5582 CVE-2016-5597 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 19, 2016 | Updated: | January 16, 2017 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
* It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy() function in certain cases. An untrusted Java application or applet could use this flaw to corrupt virtual machine's memory and completely bypass Java sandbox restrictions. (CVE-2016-5582) * It was discovered that the Hotspot component of OpenJDK did not properly check received Java Debug Wire Protocol (JDWP) packets. An attacker could possibly use this flaw to send debugging commands to a Java program running with debugging enabled if they could make victim's browser send HTTP requests to the JDWP port of the debugged application. (CVE-2016-5573) * It was discovered that the Libraries component of OpenJDK did not restrict the set of algorithms used for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm. (CVE-2016-5542) Note: After this update, MD2 hash algorithm and RSA keys with less than 1024 bits are no longer allowed to be used for Jar integrity verification by default. MD5 hash algorithm is expected to be disabled by default in the future updates. A newly introduced security property jdk.jar.disabledAlgorithms can be used to control the set of disabled algorithms. * A flaw was found in the way the JMX component of OpenJDK handled classloaders. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2016-5554) * A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication. (CVE-2016-5597) Note: After this update, Basic HTTP proxy authentication can no longer be used when tunneling HTTPS connection through an HTTP proxy. Newly introduced system properties jdk.http.auth.proxying.disabledSchemes and jdk.http.auth.tunneling.disabledSchemes can be used to control which authentication schemes can be requested by an HTTP proxy when proxying HTTP and HTTPS connections respectively. Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libarchive: three vulnerabilities
| Package(s): | libarchive | CVE #(s): | CVE-2016-8687 CVE-2016-8688 CVE-2016-8689 | ||||||||||||||||||||
| Created: | October 18, 2016 | Updated: | December 12, 2016 | ||||||||||||||||||||
| Description: | From the Debian LTS advisory:
Agostino Sarubbo of Gentoo discovered several security vulnerabilities in libarchive, a multi-format archive and compression library. An attacker could take advantage of these flaws to cause a buffer overflow or an out of bounds read using a carefully crafted input file. CVE-2016-8687: Agostino Sarubbo of Gentoo discovered a possible stack-based buffer overflow when printing a filename in bsdtar_expand_char() of util.c. CVE-2016-8688: Agostino Sarubbo of Gentoo discovered a possible out of bounds read when parsing multiple long lines in bid_entry() and detect_form() of archive_read_support_format_mtree.c. CVE-2016-8689: Agostino Sarubbo of Gentoo discovered a possible heap-based buffer overflow when reading corrupted 7z files in read_Header() of archive_read_support_format_7zip.c. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
libass: three vulnerabilities
| Package(s): | libass | CVE #(s): | CVE-2016-7972 CVE-2016-7970 CVE-2016-7969 | ||||||||||||||||||||||||
| Created: | October 13, 2016 | Updated: | February 21, 2017 | ||||||||||||||||||||||||
| Description: | From the Mageia advisory:
Amount of memory allocated during memory reallocation in the shaper wasn't tracked, possibly resulting in undefined behavior (CVE-2016-7972). Illegal read in Gaussian blur coefficient calculations (CVE-2016-7970). Mode 0/3 line wrapping equalization in specific cases could result in illegal reads while laying out and shaping text. (CVE-2016-7969) | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
libgd2: two vulnerabilities
| Package(s): | libgd2 | CVE #(s): | CVE-2016-6911 CVE-2016-8670 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 19, 2016 | Updated: | December 23, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian LTS advisory:
CVE-2016-6911: invalid read in gdImageCreateFromTiffPtr() (most of the code is not present in the Wheezy version) CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libgit2: two vulnerabilities
| Package(s): | libgit2 | CVE #(s): | CVE-2016-8568 CVE-2016-8569 | ||||||||||||||||||||||||||||
| Created: | October 19, 2016 | Updated: | January 19, 2017 | ||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
CVE-2016-8568:
* Read out-of-bounds in git_oid_nfmt:
CVE-2016-8569:
* DoS using a null pointer dereference in git_commit_message:
Proposed patch: | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
mpg123: denial of service
| Package(s): | mpg123 | CVE #(s): | CVE-2016-1000247 | ||||||||
| Created: | October 17, 2016 | Updated: | October 26, 2016 | ||||||||
| Description: | From the Debian LTS advisory:
Jerold Hoong discovered a flaw in the id3 tag processing code of libmpg123. A specially crafted mp3 input file could be used to cause a buffer over-read, resulting in a denial of service. | ||||||||||
| Alerts: |
| ||||||||||
qemu: three vulnerabilities
| Package(s): | qemu | CVE #(s): | CVE-2016-7466 CVE-2016-8576 CVE-2016-7995 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 19, 2016 | Updated: | October 26, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
CVE-2016-7466: Quick Emulator(Qemu) built with the USB xHCI controller emulation support is vulnerable to a memory leakage issue. It could occur while doing a USB device unplug operation; Doing so repeatedly would result in leaking host memory, affecting other services on the host. A privileged user inside guest could use this flaw to cause a DoS on the host and/or potentially crash the Qemu process instance on the host. CVE-2016-8576: Quick Emulator(Qemu) built with the USB xHCI controller emulation support is vulnerable to an infinite loop issue. It could occur while processing USB command ring in 'xhci_ring_fetch'. A privileged user/process inside guest could use this issue to crash the Qemu process on the host leading to DoS. CVE-2016-7995: Qemu emulator(Qemu) built with the USB EHCI emulation support is vulnerable to a memory leakage flaw. It could occur while processing isochronous transfer descriptors(iTD), with buffer page select(PG) index that falls beyond buffer page array area. A privileged user inside guest could use this flaw to leak Qemu memory bytes leading to a DoS on the host. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
quagga: stack overrun
| Package(s): | quagga | CVE #(s): | CVE-2016-1245 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 18, 2016 | Updated: | November 14, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian LTS advisory:
It was discovered that there was stack overrun in IPv6 RA receive code in quagga, a BGP/OSPF/RIP routing daemon. | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||
ruby: encrypted ciphertext duplication
| Package(s): | ruby | CVE #(s): | CVE-2016-7798 | ||||
| Created: | October 13, 2016 | Updated: | October 19, 2016 | ||||
| Description: | From the Mageia advisory:
A bug in openssl module caused using an all 0 IV for AES-GCM ciphers in some cases (when setting a key, an iv, and then setting a key a again. | ||||||
| Alerts: |
| ||||||
tiff: denial of service
| Package(s): | tiff | CVE #(s): | CVE-2016-3622 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 13, 2016 | Updated: | October 19, 2016 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entry:
The fpAcc function in tif_predict.c in the tiff2rgba tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted TIFF image. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
tor: denial of service
| Package(s): | tor | CVE #(s): | CVE-2016-8860 | ||||||||||||||||||||||||||||
| Created: | October 19, 2016 | Updated: | December 26, 2016 | ||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
It has been discovered that Tor treats the contents of some buffer chunks as if they were a NUL-terminated string. This issue could enable a remote attacker to crash a Tor client, hidden service, relay, or authority. CVE assignment email. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
xen: information leak/corruption
| Package(s): | xen | CVE #(s): | CVE-2016-7777 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 14, 2016 | Updated: | November 3, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entry:
Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>