SB2018051002 - Debian update for linux
Published: May 10, 2018
Security Bulletin ID
SB2018051002
Severity
Medium
Patch available
YES
Number of vulnerabilities
3
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Improper check or handling of exceptional conditions (CVE-ID: CVE-2018-1087)
The vulnerability allows an adjacent attacker to cause DoS condition or gain elevated privileges on the target system.The weakness exists in the Linux kernel KVM hypervisor due to improper handling of debug exceptions delivered after a stack switch operation via mov SS or pop SS instructions. During the stack switch operation, the exceptions are deferred. An adjacent attacker can cause the service to crash or gain root privileges.
2) Privilege escalation (CVE-ID: CVE-2018-8897)
The vulnerability allows a local attacker to gain elevated privileges on the target system.The vulnerability exists due to improper implementation of Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) on multiple system kernels, which results in an unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS. A local user can execute arbitrary code with elevated privileges.
3) Improper initialization (CVE-ID: CVE-2018-1108)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists in the crng_ready() function due to improper initialization. A remote attacker can cause the service to crash.
Remediation
Install update from vendor's website.