SB2017062912 - Ubuntu update for Linux kernel (regression) 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017062912

SB2017062912 - Ubuntu update for Linux kernel (regression)

Published: June 29, 2017

Security Bulletin ID SB2017062912
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Memory corruption (CVE-ID: CVE-2017-1000364)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to memory management errors in implementation of various functions under multiple operating systems. A local or remote attacker can trigger the affected application to process specially crafted data, trigger memory corruption and execute arbitrary code on the target system. The vulnerability is dubbed by Qualys researchers as “Stack Clash”.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


2) Memory corruption (CVE-ID: CVE-2016-4997)

The vulnerability allows a local user to obtain elevated privileges on the target system.

The vulnerability exists due to a memory corruption error in the IPT_SO_SET_REPLACE compat_setsockopt() function.

Successful exploitation of this vulnerability may lead to arbitrary code execution with kernel-level privileges.

Remediation

Install update from vendor's website.

References