SB2019081462 - Slackware Linux update for Slackware 14.2 kernel
Published: August 14, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2017-18509)
The vulnerability allows a local authenticated user to execute arbitrary code.
An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels before 4.9.187.
2) Use-after-free (CVE-ID: CVE-2018-20856)
The vulnerability allows a local attacker to execute arbitrary code on a targeted system.
The vulnerability exists due to a use-after-free error when the "__blk_drain_queue()" function in the "block/blk-core.c" file mishandles error cases. A local authenticated attacker can access the system and execute an application that submits malicious input, cause a use-after-free memory operation error and execute arbitrary code on the targeted system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
3) NULL pointer dereference (CVE-ID: CVE-2019-10207)
The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.
A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and kernel 5.x.x. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the system to crash.
4) Information disclosure (CVE-ID: CVE-2019-1125)
The vulnerability allows a local user to gain access to potentially sensitive information and elevate privileges on the system.
The vulnerability exists when certain central processing units (CPU) speculatively access memory. A local user can gain unauthorized access to sensitive information and elevate privileges on the system.
This issue is a variant of the Spectre Variant 1 speculative execution side channel vulnerability that leverages SWAPGS instructions to bypass KPTI/KVA mitigations.
5) Out-of-bounds write (CVE-ID: CVE-2019-13631)
6) Resource management error (CVE-ID: CVE-2019-13648)
The vulnerability allows a local attacker to perform a denial of service (DoS) attack.
The vulnerability exists in the "arch/powerpc/kernel/signal_32.c" and "arch/powerpc/kernel/signal_64.c" files on the PowerPC platform, when hardware transactional memory is disabled. A local authenticated attacker can make a "sigreturn()" system call that sends a signal frame that sends a signal frame that submits malicious input to the targeted system and cause a denial of service condition.
7) Integer overflow (CVE-ID: CVE-2019-14283)
The vulnerability allows a local attacker to execute arbitrary code or cause a denial of service (DoS) condition on a targeted system.
The vulnerability exists due to the "set_geometry" function in the "drivers/block/floppy.c" file does not properly validate the sect and head fields. A local authenticated attacker can insert a floppy disk that submits malicious input to the targeted system, trigger integer overflow, which could cause an out-of-bounds write condition and execute arbitrary code on the target system or cause a DoS condition.
8) Resource exhaustion (CVE-ID: CVE-2019-14284)
The vulnerability allows a local attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a divide-by-zero condition in the "drivers/block/floppy.c" file. A local authenticated attacker can insert a floppy disk that submits malicious input to the targeted system, trigger resource exhaustion and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.