ID CVE-2015-2666
Summary Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd.
References
Vulnerable Configurations
  • Linux Kernel 3.19.8
    cpe:2.3:o:linux:linux_kernel:3.19.8
CVSS
Base: 6.9 (as of 27-05-2015 - 11:57)
Impact:
Exploitability:
CWE CWE-119
CAPEC
  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
  • Overflow Binary Resource File
    An attack of this type exploits a buffer overflow vulnerability in the handling of binary resources. Binary resources may include music files like MP3, image files like JPEG files, and any other binary file. These attacks may pass unnoticed to the client machine through normal usage of files, such as a browser loading a seemingly innocent JPEG file. This can allow the attacker access to the execution stack and execute arbitrary code in the target process. This attack pattern is a variant of standard buffer overflow attacks using an unexpected vector (binary files) to wrap its attack and open up a new attack vector. The attacker is required to either directly serve the binary content to the victim, or place it in a locale like a MP3 sharing application, for the victim to download. The attacker then is notified upon the download or otherwise locates the vulnerability opened up by the buffer overflow.
  • Buffer Overflow via Symbolic Links
    This type of attack leverages the use of symbolic links to cause buffer overflows. An attacker can try to create or manipulate a symbolic link file such that its contents result in out of bounds data. When the target software processes the symbolic link file, it could potentially overflow internal buffers with insufficient bounds checking.
  • Overflow Variables and Tags
    This type of attack leverages the use of tags or variables from a formatted configuration data to cause buffer overflow. The attacker crafts a malicious HTML page or configuration file that includes oversized strings, thus causing an overflow.
  • Buffer Overflow via Parameter Expansion
    In this attack, the target software is given input that the attacker knows will be modified and expanded in size during processing. This attack relies on the target software failing to anticipate that the expanded data may exceed some internal limit, thereby creating a buffer overflow.
  • Buffer Overflow in an API Call
    This attack targets libraries or shared code modules which are vulnerable to buffer overflow attacks. An attacker who has access to an API may try to embed malicious code in the API function call and exploit a buffer overflow vulnerability in the function's implementation. All clients that make use of the code library thus become vulnerable by association. This has a very broad effect on security across a system, usually affecting more than one software process.
  • Buffer Overflow in Local Command-Line Utilities
    This attack targets command-line utilities available in a number of shells. An attacker can leverage a vulnerability found in a command-line utility to escalate privilege to root.
Access
VectorComplexityAuthentication
LOCAL MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
nessus via4
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-124.NASL
    description The openSUSE 13.1 kernel was updated to receive various security and bugfixes. Following security bugs were fixed : - CVE-2016-0728: A reference leak in keyring handling with join_session_keyring() could lead to local attackers gain root privileges. (bsc#962075). - CVE-2015-7550: A local user could have triggered a race between read and revoke in keyctl (bnc#958951). - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel did not verify an address length, which allowed local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application (bnc#959190). - CVE-2015-8543: The networking implementation in the Linux kernel did not validate protocol identifiers for certain protocol families, which allowed local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application (bnc#958886). - CVE-2014-8989: The Linux kernel did not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allowed local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a 'negative groups' issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c (bnc#906545). - CVE-2015-5157: arch/x86/entry/entry_64.S in the Linux kernel on the x86_64 platform mishandles IRET faults in processing NMIs that occurred during userspace execution, which might allow local users to gain privileges by triggering an NMI (bnc#937969). - CVE-2015-7799: The slhc_init function in drivers/net/slip/slhc.c in the Linux kernel through 4.2.3 did not ensure that certain slot numbers are valid, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted PPPIOCSMAXCID ioctl call (bnc#949936). - CVE-2015-8104: The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allowed guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c (bnc#954404). - CVE-2015-5307: The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allowed guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c (bnc#953527). - CVE-2014-9529: Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel allowed local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key (bnc#912202). - CVE-2015-7990: Race condition in the rds_sendmsg function in net/rds/sendmsg.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6937 (bnc#952384 953052). - CVE-2015-6937: The __rds_conn_create function in net/rds/connection.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound (bnc#945825). - CVE-2015-7885: The dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel through 4.3.3 did not initialize a certain structure member, which allowed local users to obtain sensitive information from kernel memory via a crafted application (bnc#951627). - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel did not validate attempted changes to the MTU value, which allowed context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product (bnc#955354). - CVE-2015-8767: A case can occur when sctp_accept() is called by the user during a heartbeat timeout event after the 4-way handshake. Since sctp_assoc_migrate() changes both assoc->base.sk and assoc->ep, the bh_sock_lock in sctp_generate_heartbeat_event() will be taken with the listening socket but released with the new association socket. The result is a deadlock on any future attempts to take the listening socket lock. (bsc#961509) - CVE-2015-8575: Validate socket address length in sco_sock_bind() to prevent information leak (bsc#959399). - CVE-2015-8551, CVE-2015-8552: xen/pciback: For XEN_PCI_OP_disable_msi[|x] only disable if device has MSI(X) enabled (bsc#957990). - CVE-2015-8550: Compiler optimizations in the XEN PV backend drivers could have lead to double fetch vulnerabilities, causing denial of service or arbitrary code execution (depending on the configuration) (bsc#957988). The following non-security bugs were fixed : - ALSA: hda - Disable 64bit address for Creative HDA controllers (bnc#814440). - ALSA: hda - Fix noise problems on Thinkpad T440s (boo#958504). - Input: aiptek - fix crash on detecting device without endpoints (bnc#956708). - KEYS: Make /proc/keys unconditional if CONFIG_KEYS=y (boo#956934). - KVM: x86: update masterclock values on TSC writes (bsc#961739). - NFS: Fix a NULL pointer dereference of migration recovery ops for v4.2 client (bsc#960839). - apparmor: allow SYS_CAP_RESOURCE to be sufficient to prlimit another task (bsc#921949). - blktap: also call blkif_disconnect() when frontend switched to closed (bsc#952976). - blktap: refine mm tracking (bsc#952976). - cdrom: Random writing support for BD-RE media (bnc#959568). - genksyms: Handle string literals with spaces in reference files (bsc#958510). - ipv4: Do not increase PMTU with Datagram Too Big message (bsc#955224). - ipv6: distinguish frag queues by device for multicast and link-local packets (bsc#955422). - ipv6: fix tunnel error handling (bsc#952579). - route: Use ipv4_mtu instead of raw rt_pmtu (bsc#955224). - uas: Add response iu handling (bnc#954138). - usbvision fix overflow of interfaces array (bnc#950998). - x86/evtchn: make use of PHYSDEVOP_map_pirq. - xen/pciback: Do not allow MSI-X ops if PCI_COMMAND_MEMORY is not set (bsc#957990 XSA-157).
    last seen 2019-02-21
    modified 2016-12-07
    plugin id 88545
    published 2016-02-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=88545
    title openSUSE Security Update : the Linux Kernel (openSUSE-2016-124)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2015-4457.NASL
    description The 3.19.2 stable update contains a number of important fixes across the tree.1205244 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 82311
    published 2015-03-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82311
    title Fedora 21 : kernel-3.19.2-201.fc21 (2015-4457)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2590-1.NASL
    description Jan Beulich discovered the Xen virtual machine subsystem of the Linux kernel did not properly restrict access to PCI command registers. A local guest user could exploit this flaw to cause a denial of service (host crash). (CVE-2015-2150) A stack overflow was discovered in the the microcode loader for the intel x86 platform. A local attacker could exploit this flaw to cause a denial of service (kernel crash) or to potentially execute code with kernel privileges. (CVE-2015-2666) A privilege escalation was discovered in the fork syscal vi the int80 entry on 64 bit kernels with 32 bit emulation support. An unprivileged local attacker could exploit this flaw to increase their privileges on the system. (CVE-2015-2830) It was discovered that the Linux kernel's IPv6 networking stack has a flaw that allows using route advertisement (RA) messages to set the 'hop_limit' to values that are too low. An unprivileged attacker on a local network could exploit this flaw to cause a denial of service (IPv6 messages dropped). (CVE-2015-2922). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 83181
    published 2015-05-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83181
    title Ubuntu 14.10 : linux vulnerabilities (USN-2590-1)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20150805_KERNEL_ON_SL7_X.NASL
    description * An integer overflow flaw was found in the way the Linux kernel's netfilter connection tracking implementation loaded extensions. An attacker on a local network could potentially send a sequence of specially crafted packets that would initiate the loading of a large number of extensions, causing the targeted system in that network to crash. (CVE-2014-9715, Moderate) * A stack-based buffer overflow flaw was found in the Linux kernel's early load microcode functionality. On a system with UEFI Secure Boot enabled, a local, privileged user could use this flaw to increase their privileges to the kernel (ring0) level, bypassing intended restrictions in place. (CVE-2015-2666, Moderate) * It was found that the Linux kernel's ping socket implementation did not properly handle socket unhashing during spurious disconnects, which could lead to a use-after-free flaw. On x86-64 architecture systems, a local user able to create ping sockets could use this flaw to crash the system. On non-x86-64 architecture systems, a local user able to create ping sockets could use this flaw to escalate their privileges on the system. (CVE-2015-3636, Moderate) * It was found that the Linux kernel's TCP/IP protocol suite implementation for IPv6 allowed the Hop Limit value to be set to a smaller value than the default one. An attacker on a local network could use this flaw to prevent systems on that network from sending or receiving network packets. (CVE-2015-2922, Low) This update also fixes several bugs. The system must be rebooted for this update to take effect.
    last seen 2019-02-21
    modified 2018-12-28
    plugin id 85264
    published 2015-08-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=85264
    title Scientific Linux Security Update : kernel on SL7.x x86_64
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2015-1565.NASL
    description Updated kernel-rt packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. * An integer overflow flaw was found in the way the Linux kernel's netfilter connection tracking implementation loaded extensions. An attacker on a local network could potentially send a sequence of specially crafted packets that would initiate the loading of a large number of extensions, causing the targeted system in that network to crash. (CVE-2014-9715, Moderate) * A stack-based buffer overflow flaw was found in the Linux kernel's early load microcode functionality. On a system with UEFI Secure Boot enabled, a local, privileged user could use this flaw to increase their privileges to the kernel (ring0) level, bypassing intended restrictions in place. (CVE-2015-2666, Moderate) * It was found that the Linux kernel's ping socket implementation did not properly handle socket unhashing during spurious disconnects, which could lead to a use-after-free flaw. On x86-64 architecture systems, a local user able to create ping sockets could use this flaw to crash the system. On non-x86-64 architecture systems, a local user able to create ping sockets could use this flaw to escalate their privileges on the system. (CVE-2015-3636, Moderate) * It was found that the Linux kernel's TCP/IP protocol suite implementation for IPv6 allowed the Hop Limit value to be set to a smaller value than the default one. An attacker on a local network could use this flaw to prevent systems on that network from sending or receiving network packets. (CVE-2015-2922, Low) Red Hat would like to thank Nathan Hoad for reporting the CVE-2014-9715 issue. The kernel-rt packages have been upgraded to version 3.10.0-229.11.1, which provides a number of bug fixes and enhancements over the previous version, including : * drbg: Add stdrng alias and increase priority * seqiv / eseqiv / chainiv: Move IV seeding into init function * ipv4: kABI fix for 0bbf87d backport * ipv4: Convert ipv4.ip_local_port_range to be per netns * libceph: tcp_nodelay support * ipr: Increase default adapter init stage change timeout * fix use-after-free bug in usb_hcd_unlink_urb() * libceph: fix double __remove_osd() problem * ext4: fix data corruption caused by unwritten and delayed extents * sunrpc: Add missing support for RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT * nfs: Fixing lease renewal (Benjamin Coddington) * control hard lockup detection default * Fix print-once on enable * watchdog: update watchdog_thresh properly and watchdog attributes atomically * module: Call module notifier on failure after complete_formation() (BZ#1234470) This update also fixes the following bugs : * The megasas driver used the smp_processor_id() function within a preemptible context, which caused warning messages to be returned to the console. The function has been changed to raw_smp_processor_id() so that a lock is held while getting the processor ID. As a result, correct operations are now allowed without any console warnings being produced. (BZ#1235304) * In the NFSv4 file system, non-standard usage of the write_seqcount_{begin,end}() functions were used, which caused the realtime code to try to sleep while locks were held. As a consequence, the 'scheduling while atomic' error messages were returned. The underlying source code has been modified to use the __write_seqcount_{begin,end}() functions that do not hold any locks, allowing correct execution of realtime. (BZ#1235301) All kernel-rt users are advised to upgrade to these updated packages, which correct these issues and add these enhancements. The system must be rebooted for this update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 85705
    published 2015-08-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=85705
    title RHEL 7 : kernel-rt (RHSA-2015:1565)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2589-1.NASL
    description Jan Beulich discovered the Xen virtual machine subsystem of the Linux kernel did not properly restrict access to PCI command registers. A local guest user could exploit this flaw to cause a denial of service (host crash). (CVE-2015-2150) A stack overflow was discovered in the the microcode loader for the intel x86 platform. A local attacker could exploit this flaw to cause a denial of service (kernel crash) or to potentially execute code with kernel privileges. (CVE-2015-2666) A privilege escalation was discovered in the fork syscal vi the int80 entry on 64 bit kernels with 32 bit emulation support. An unprivileged local attacker could exploit this flaw to increase their privileges on the system. (CVE-2015-2830) It was discovered that the Linux kernel's IPv6 networking stack has a flaw that allows using route advertisement (RA) messages to set the 'hop_limit' to values that are too low. An unprivileged attacker on a local network could exploit this flaw to cause a denial of service (IPv6 messages dropped). (CVE-2015-2922). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 83180
    published 2015-05-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83180
    title Ubuntu 14.04 LTS : linux-lts-utopic vulnerabilities (USN-2589-1)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2015-1534.NASL
    description Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * An integer overflow flaw was found in the way the Linux kernel's netfilter connection tracking implementation loaded extensions. An attacker on a local network could potentially send a sequence of specially crafted packets that would initiate the loading of a large number of extensions, causing the targeted system in that network to crash. (CVE-2014-9715, Moderate) * A stack-based buffer overflow flaw was found in the Linux kernel's early load microcode functionality. On a system with UEFI Secure Boot enabled, a local, privileged user could use this flaw to increase their privileges to the kernel (ring0) level, bypassing intended restrictions in place. (CVE-2015-2666, Moderate) * It was found that the Linux kernel's ping socket implementation did not properly handle socket unhashing during spurious disconnects, which could lead to a use-after-free flaw. On x86-64 architecture systems, a local user able to create ping sockets could use this flaw to crash the system. On non-x86-64 architecture systems, a local user able to create ping sockets could use this flaw to escalate their privileges on the system. (CVE-2015-3636, Moderate) * It was found that the Linux kernel's TCP/IP protocol suite implementation for IPv6 allowed the Hop Limit value to be set to a smaller value than the default one. An attacker on a local network could use this flaw to prevent systems on that network from sending or receiving network packets. (CVE-2015-2922, Low) Red Hat would like to thank Nathan Hoad for reporting the CVE-2014-9715 issue. This update also fixes several bugs. Refer to the following Knowledgebase article for further information : https://access.redhat.com/articles/1474193 All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 85305
    published 2015-08-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=85305
    title CentOS 7 : kernel (CESA-2015:1534)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2015-1534.NASL
    description From Red Hat Security Advisory 2015:1534 : Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * An integer overflow flaw was found in the way the Linux kernel's netfilter connection tracking implementation loaded extensions. An attacker on a local network could potentially send a sequence of specially crafted packets that would initiate the loading of a large number of extensions, causing the targeted system in that network to crash. (CVE-2014-9715, Moderate) * A stack-based buffer overflow flaw was found in the Linux kernel's early load microcode functionality. On a system with UEFI Secure Boot enabled, a local, privileged user could use this flaw to increase their privileges to the kernel (ring0) level, bypassing intended restrictions in place. (CVE-2015-2666, Moderate) * It was found that the Linux kernel's ping socket implementation did not properly handle socket unhashing during spurious disconnects, which could lead to a use-after-free flaw. On x86-64 architecture systems, a local user able to create ping sockets could use this flaw to crash the system. On non-x86-64 architecture systems, a local user able to create ping sockets could use this flaw to escalate their privileges on the system. (CVE-2015-3636, Moderate) * It was found that the Linux kernel's TCP/IP protocol suite implementation for IPv6 allowed the Hop Limit value to be set to a smaller value than the default one. An attacker on a local network could use this flaw to prevent systems on that network from sending or receiving network packets. (CVE-2015-2922, Low) Red Hat would like to thank Nathan Hoad for reporting the CVE-2014-9715 issue. This update also fixes several bugs. Refer to the following Knowledgebase article for further information : https://access.redhat.com/articles/1474193 All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 85247
    published 2015-08-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=85247
    title Oracle Linux 7 : kernel (ELSA-2015-1534)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2015-1071-1.NASL
    description The SUSE Linux Enterprise 12 kernel was updated to version 3.12.43 to receive various security and bugfixes. Following security bugs were fixed : - CVE-2014-3647: arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 did not properly perform RIP changes, which allowed guest OS users to cause a denial of service (guest OS crash) via a crafted application (bsc#899192). - CVE-2014-8086: Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allowed local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag (bsc#900881). - CVE-2014-8159: The InfiniBand (IB) implementation did not properly restrict use of User Verbs for registration of memory regions, which allowed local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/ (bsc#914742). - CVE-2015-1465: The IPv4 implementation in the Linux kernel before 3.18.8 did not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allowed remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets (bsc#916225). - CVE-2015-2041: net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 used an incorrect data type in a sysctl table, which allowed local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry (bsc#919007). - CVE-2015-2042: net/rds/sysctl.c in the Linux kernel before 3.19 used an incorrect data type in a sysctl table, which allowed local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry (bsc#919018). - CVE-2015-2666: Fixed a flaw that allowed crafted microcode to overflow the kernel stack (bsc#922944). - CVE-2015-2830: Fixed int80 fork from 64-bit tasks mishandling (bsc#926240). - CVE-2015-2922: Fixed possible denial of service (DoS) attack against IPv6 network stacks due to improper handling of Router Advertisements (bsc#922583). - CVE-2015-3331: Fixed buffer overruns in RFC4106 implementation using AESNI (bsc#927257). - CVE-2015-3332: Fixed TCP Fast Open local DoS (bsc#928135). - CVE-2015-3339: Fixed race condition flaw between the chown() and execve() system calls which could have lead to local privilege escalation (bsc#928130). - CVE-2015-3636: Fixed use-after-free in ping sockets which could have lead to local privilege escalation (bsc#929525). The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-29
    plugin id 84227
    published 2015-06-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=84227
    title SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2015:1071-1)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2588-1.NASL
    description A stack overflow was discovered in the the microcode loader for the intel x86 platform. A local attacker could exploit this flaw to cause a denial of service (kernel crash) or to potentially execute code with kernel privileges. (CVE-2015-2666) It was discovered that the Linux kernel's IPv6 networking stack has a flaw that allows using route advertisement (RA) messages to set the 'hop_limit' to values that are too low. An unprivileged attacker on a local network could exploit this flaw to cause a denial of service (IPv6 messages dropped). (CVE-2015-2922). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 83179
    published 2015-05-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83179
    title Ubuntu 14.04 LTS : linux vulnerabilities (USN-2588-1)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2015-1534.NASL
    description Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. * An integer overflow flaw was found in the way the Linux kernel's netfilter connection tracking implementation loaded extensions. An attacker on a local network could potentially send a sequence of specially crafted packets that would initiate the loading of a large number of extensions, causing the targeted system in that network to crash. (CVE-2014-9715, Moderate) * A stack-based buffer overflow flaw was found in the Linux kernel's early load microcode functionality. On a system with UEFI Secure Boot enabled, a local, privileged user could use this flaw to increase their privileges to the kernel (ring0) level, bypassing intended restrictions in place. (CVE-2015-2666, Moderate) * It was found that the Linux kernel's ping socket implementation did not properly handle socket unhashing during spurious disconnects, which could lead to a use-after-free flaw. On x86-64 architecture systems, a local user able to create ping sockets could use this flaw to crash the system. On non-x86-64 architecture systems, a local user able to create ping sockets could use this flaw to escalate their privileges on the system. (CVE-2015-3636, Moderate) * It was found that the Linux kernel's TCP/IP protocol suite implementation for IPv6 allowed the Hop Limit value to be set to a smaller value than the default one. An attacker on a local network could use this flaw to prevent systems on that network from sending or receiving network packets. (CVE-2015-2922, Low) Red Hat would like to thank Nathan Hoad for reporting the CVE-2014-9715 issue. This update also fixes several bugs. Refer to the following Knowledgebase article for further information : https://access.redhat.com/articles/1474193 All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 85248
    published 2015-08-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=85248
    title RHEL 7 : kernel (RHSA-2015:1534)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2015-302.NASL
    description The Linux kernel was updated to fix bugs and security issues : Following security issues were fixed: CVE-2015-2830: A flaw was found in the way the Linux kernels 32-bit emulation implementation handled forking or closing of a task with an int80 entry. A local user could have potentially used this flaw to escalate their privileges on the system. CVE-2015-2042: A kernel information leak in rds sysctl files was fixed. CVE-2014-9683: Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel allowed local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename. CVE-2015-0275: A BUG_ON in ext4 was fixed which could be triggered by local users. CVE-2015-2666: A buffer overflow when loading microcode files into the kernel could be used by the administrator to execute code in the kernel, bypassing secure boot measures. - CVE-2015-1421: Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel allowed remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data. - CVE-2015-2150: XSA-120: Guests were permitted to modify all bits of the PCI command register of passed through cards, which could lead to Host system crashes. - CVE-2015-0777: The XEN usb backend could leak information to the guest system due to copying uninitialized memory. - CVE-2015-1593: A integer overflow reduced the effectiveness of the stack randomization on 64-bit systems. - CVE-2014-9419: The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel did not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which made it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address. - CVE-2014-9428: The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the Linux kernel used an incorrect length field during a calculation of an amount of memory, which allowed remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets. - CVE-2014-8160: net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel generated incorrect conntrack entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols, which allowed remote attackers to bypass intended access restrictions via packets with disallowed port numbers. - CVE-2014-9529: Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel allowed local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key. - CVE-2014-9420: The rock_continue function in fs/isofs/rock.c in the Linux kernel did not restrict the number of Rock Ridge continuation entries, which allowed local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image. - CVE-2014-9584: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel did not validate a length value in the Extensions Reference (ER) System Use Field, which allowed local users to obtain sensitive information from kernel memory via a crafted iso9660 image. - CVE-2014-9585: The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel did not properly choose memory locations for the vDSO area, which made it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD. - CVE-2014-8559: The d_walk function in fs/dcache.c in the Linux kernel through did not properly maintain the semantics of rename_lock, which allowed local users to cause a denial of service (deadlock and system hang) via a crafted application. - CVE-2014-8134: The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel used an improper paravirt_enabled setting for KVM guest kernels, which made it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value. Following bugs were fixed : - powerpc/pci: Fix IO space breakage after of_pci_range_to_resource() change (bnc#922542). - cifs: fix use-after-free bug in find_writable_file (bnc#909477). - usb: Do not allow usb_alloc_streams on unconfigured devices (bsc#920581). - fuse: honour max_read and max_write in direct_io mode (bnc#918954). - switch iov_iter_get_pages() to passing maximal number of pages (bnc#918954). - bcache: fix a livelock in btree lock v2 (bnc#910440) (bnc#910440). Updated because another version went upstream - drm/i915: Initialise userptr mmu_notifier serial to 1 (bnc#918970). - NFS: Don't try to reclaim delegation open state if recovery failed (boo#909634). - NFSv4: Ensure that we call FREE_STATEID when NFSv4.x stateids are revoked (boo#909634). - NFSv4: Fix races between nfs_remove_bad_delegation() and delegation return (boo#909634). - NFSv4: Ensure that we remove NFSv4.0 delegations when state has expired (boo#909634). - Fixing lease renewal (boo#909634). - bcache: Fix a bug when detaching (bsc#908582). - fix a leak in bch_cached_dev_run() (bnc#910440). - bcache: unregister reboot notifier when bcache fails to register a block device (bnc#910440). - bcache: fix a livelock in btree lock (bnc#910440). - bcache: [BUG] clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing device (bnc#910440). - bcache: Add a cond_resched() call to gc (bnc#910440). - storvsc: ring buffer failures may result in I/O freeze (bnc#914175). - ALSA: seq-dummy: remove deadlock-causing events on close (boo#916608). - ALSA: pcm: Zero-clear reserved fields of PCM status ioctl in compat mode (boo#916608). - ALSA: bebob: Uninitialized id returned by saffirepro_both_clk_src_get (boo#916608). - ALSA: hda - Fix built-in mic on Compaq Presario CQ60 (bnc#920604). - ALSA: hda - Fix regression of HD-audio controller fallback modes (bsc#921313). - [media] sound: Update au0828 quirks table (boo#916608). - [media] sound: simplify au0828 quirk table (boo#916608). - ALSA: usb-audio: Add mic volume fix quirk for Logitech Webcam C210 (boo#916608). - ALSA: usb-audio: extend KEF X300A FU 10 tweak to Arcam rPAC (boo#916608). - ALSA: usb-audio: Add ctrl message delay quirk for Marantz/Denon devices (boo#916608). - ALSA: usb-audio: Fix memory leak in FTU quirk (boo#916608). - ALSA: usb-audio: Fix device_del() sysfs warnings at disconnect (boo#916608). - ALSA: hda - Add new GPU codec ID 0x10de0072 to snd-hda (boo#916608). - ALSA: hda - Fix wrong gpio_dir & gpio_mask hint setups for IDT/STAC codecs (boo#916608). - ALSA: hda/realtek - New codec support for ALC298 (boo#916608). - ALSA: hda/realtek - New codec support for ALC256 (boo#916608). - ALSA: hda/realtek - Add new Dell desktop for ALC3234 headset mode (boo#916608). - ALSA: hda - Add EAPD fixup for ASUS Z99He laptop (boo#916608). - ALSA: hda - Fix built-in mic at resume on Lenovo Ideapad S210 (boo#916608). - ALSA: hda/realtek - Add headset Mic support for new Dell machine (boo#916608). - ALSA: hda_intel: Add DeviceIDs for Sunrise Point-LP (boo#916608). - ALSA: hda_intel: Add Device IDs for Intel Sunrise Point PCH (boo#916608). - ALSA: hda - add codec ID for Braswell display audio codec (boo#916608). - ALSA: hda - add PCI IDs for Intel Braswell (boo#916608). - ALSA: hda - Add dock support for Thinkpad T440 (17aa:2212) (boo#916608). - ALSA: hda - Set up GPIO for Toshiba Satellite S50D (bnc#915858). - rpm/kernel-binary.spec.in: Fix build if there is no *.crt file - mm, vmscan: prevent kswapd livelock due to pfmemalloc-throttled process being killed (VM Functionality bnc#910150). - Input: evdev - fix EVIOCG{type} ioctl (bnc#904899). - mnt: Implicitly add MNT_NODEV on remount when it was implicitly added by mount (bsc#907988). - Btrfs: fix scrub race leading to use-after-free (bnc#915456). - Btrfs: fix setup_leaf_for_split() to avoid leaf corruption (bnc#915454). - Btrfs: fix fsync log replay for inodes with a mix of regular refs and extrefs (bnc#915425). - Btrfs: fix fsync when extend references are added to an inode (bnc#915425). - Btrfs: fix directory inconsistency after fsync log replay (bnc#915425). - Btrfs: make xattr replace operations atomic (bnc#913466). - Btrfs: fix directory recovery from fsync log (bnc#895797). - Btrfs: simplify insert_orphan_item (boo#926385). - Btrfs: set proper message level for skinny metadata. - Btrfs: make sure we wait on logged extents when fsycning two subvols. - Btrfs: fix lost return value due to variable shadowing. - Btrfs: fix leak of path in btrfs_find_item. - Btrfs: fix fsync data loss after adding hard link to inode. - Btrfs: fix fs corruption on transaction abort if device supports discard. - Btrfs: fix data loss in the fast fsync path. - Btrfs: don't delay inode ref updates during log replay. - Btrfs: do not move em to modified list when unpinning. - Btrfs:__add_inode_ref: out of bounds memory read when looking for extended ref. - Btrfs: fix inode eviction infinite loop after cloning into it (boo#905088). - bcache: add mutex lock for bch_is_open (bnc#908612). - bcache: Correct printing of btree_gc_max_duration_ms (bnc#908610). - bcache: fix crash with incomplete cache set (bnc#908608). - bcache: fix memory corruption in init error path (bnc#908606). - bcache: Fix more early shutdown bugs (bnc#908605). - bcache: fix use-after-free in btree_gc_coalesce() (bnc#908604). - bcache: Fix an infinite loop in journal replay (bnc#908603). - bcache: fix typo in bch_bkey_equal_header (bnc#908598). - bcache: Make sure to pass GFP_WAIT to mempool_alloc() (bnc#908596). - bcache: fix crash on shutdown in passthrough mode (bnc#908594). - bcache: fix lockdep warnings on shutdown (bnc#908593). - bcache allocator: send discards with correct size (bnc#908592). - bcache: Fix to remove the rcu_sched stalls (bnc#908589). - bcache: Fix a journal replay bug (bnc#908588). - Update x86_64 config files: CONFIG_SENSORS_NCT6683=m The nct6683 driver is already enabled on i386 and history suggests that it not being enabled on x86_64 is by mistake. - rpm/kernel-binary.spec.in: Own the modules directory in the devel package (bnc#910322) - Revert 'iwlwifi: mvm: treat EAPOLs like mgmt frames wrt rate' (bnc#900811). - mm: free compound page with correct order (bnc#913695). - drm/i915: More cautious with pch fifo underruns (boo#907039). - Refresh patches.arch/arm64-0039-generic-pci.patch (fix PCI bridge support) - x86/microcode/intel: Fish out the stashed microcode for the BSP (bsc#903589). - x86, microcode: Reload microcode on resume (bsc#903589). - x86, microcode: Don't initialize microcode code on paravirt (bsc#903589). - x86, microcode, intel: Drop unused parameter (bsc#903589). - x86, microcode, AMD: Do not use smp_processor_id() in preemtible context (bsc#903589). - x86, microcode: Update BSPs microcode on resume (bsc#903589). - x86, microcode, AMD: Fix ucode patch stashing on 32-bit (bsc#903589). - x86, microcode: Fix accessing dis_ucode_ldr on 32-bit (bsc#903589). - x86, microcode, AMD: Fix early ucode loading on 32-bit (bsc#903589). - Bluetooth: Add support for Broadcom BCM20702A0 variants firmware download (bnc#911311). - drm/radeon: fix sad_count check for dce3 (bnc#911356). - drm/i915: Don't call intel_prepare_page_flip() multiple times on gen2-4 (bnc#911835). - udf: Check component length before reading it. - udf: Check path length when reading symlink. - udf: Verify symlink size before loading it. - udf: Verify i_size when loading inode. - arm64: Enable DRM - arm64: Enable generic PHB driver (bnc#912061). - ACPI / video: Add some Samsung models to disable_native_backlight list (boo#905681). - asus-nb-wmi: Add another wapf=4 quirk (boo#911438). - asus-nb-wmi: Add wapf4 quirk for the X550VB (boo#911438). - asus-nb-wmi: Add wapf4 quirk for the U32U (boo#911438). - asus-nb-wmi: Add wapf4 quirk for the X550CC (boo#911438). - asus-nb-wmi: Constify asus_quirks DMI table (boo#911438). - asus-nb-wmi: Add wapf4 quirk for the X550CL (boo#911438). - asus-nb-wmi.c: Rename x401u quirk to wapf4 (boo#911438). - asus-nb-wmi: Add ASUSTeK COMPUTER INC. X200CA (boo#911438). - WAPF 4 for ASUSTeK COMPUTER INC. X75VBP WLAN ON (boo#911438). - Input: synaptics - gate forcepad support by DMI check (bnc#911578). - ext4: introduce aging to extent status tree (bnc#893428). - ext4: cleanup flag definitions for extent status tree (bnc#893428). - ext4: limit number of scanned extents in status tree shrinker (bnc#893428). - ext4: move handling of list of shrinkable inodes into extent status code (bnc#893428). - ext4: change LRU to round-robin in extent status tree shrinker (bnc#893428). - ext4: cache extent hole in extent status tree for ext4_da_map_blocks() (bnc#893428). - ext4: fix block reservation for bigalloc filesystems (bnc#893428). - ext4: track extent status tree shrinker delay statictics (bnc#893428). - ext4: improve extents status tree trace point (bnc#893428). - rpm/kernel-binary.spec.in: Provide name-version-release for kgraft packages (bnc#901925) - rpm/kernel-binary.spec.in: Fix including the secure boot cert in /etc/uefi/certs - doc/README.SUSE: update Solid Driver team contacts - rpm/kernel-binary.spec.in: Do not sign firmware files (bnc#867199) - Port module signing changes from SLE11-SP3 (fate#314508) - doc/README.PATCH-POLICY.SUSE: add patch policy / best practices document after installation. - Update config files. (boo#925479) Do not set CONFIG_SYSTEM_TRUSTED_KEYRING until we need it in future openSUSE version: e.g. MODULE_SIG, IMA, PKCS7(new), KEXEC_BZIMAGE_VERIFY_SIG(new) - Input: xpad - use proper endpoint type (bnc#926397). - md: don't require sync_min to be a multiple of chunk_size (bnc#910500).
    last seen 2019-02-21
    modified 2015-04-23
    plugin id 82756
    published 2015-04-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82756
    title openSUSE Security Update : Linux Kernel (openSUSE-2015-302)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2587-1.NASL
    description A stack overflow was discovered in the the microcode loader for the intel x86 platform. A local attacker could exploit this flaw to cause a denial of service (kernel crash) or to potentially execute code with kernel privileges. (CVE-2015-2666) It was discovered that the Linux kernel's IPv6 networking stack has a flaw that allows using route advertisement (RA) messages to set the 'hop_limit' to values that are too low. An unprivileged attacker on a local network could exploit this flaw to cause a denial of service (IPv6 messages dropped). (CVE-2015-2922). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 83178
    published 2015-05-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83178
    title Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2587-1)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2015-5024.NASL
    description The 3.19.3 rebase contains improved hardware support, a number of new features, and many important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2016-10-18
    plugin id 82630
    published 2015-04-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82630
    title Fedora 20 : kernel-3.19.3-100.fc20 (2015-5024)
redhat via4
advisories
rhsa
id RHSA-2015:1534
rpms
  • kernel-0:3.10.0-229.11.1.el7
  • kernel-abi-whitelists-0:3.10.0-229.11.1.el7
  • kernel-bootwrapper-0:3.10.0-229.11.1.el7
  • kernel-debug-0:3.10.0-229.11.1.el7
  • kernel-debug-devel-0:3.10.0-229.11.1.el7
  • kernel-devel-0:3.10.0-229.11.1.el7
  • kernel-doc-0:3.10.0-229.11.1.el7
  • kernel-headers-0:3.10.0-229.11.1.el7
  • kernel-kdump-0:3.10.0-229.11.1.el7
  • kernel-kdump-devel-0:3.10.0-229.11.1.el7
  • kernel-tools-0:3.10.0-229.11.1.el7
  • kernel-tools-libs-0:3.10.0-229.11.1.el7
  • kernel-tools-libs-devel-0:3.10.0-229.11.1.el7
  • perf-0:3.10.0-229.11.1.el7
  • python-perf-0:3.10.0-229.11.1.el7
  • kernel-rt-0:3.10.0-229.11.1.rt56.141.11.el7_1
  • kernel-rt-debug-0:3.10.0-229.11.1.rt56.141.11.el7_1
  • kernel-rt-debug-devel-0:3.10.0-229.11.1.rt56.141.11.el7_1
  • kernel-rt-devel-0:3.10.0-229.11.1.rt56.141.11.el7_1
  • kernel-rt-doc-0:3.10.0-229.11.1.rt56.141.11.el7_1
  • kernel-rt-trace-0:3.10.0-229.11.1.rt56.141.11.el7_1
  • kernel-rt-trace-devel-0:3.10.0-229.11.1.rt56.141.11.el7_1
refmap via4
confirm
fedora FEDORA-2015-4457
mlist [oss-security] 20150320 Re: CVE Request: Linux kernel execution in the early microcode loader.
sectrack 1032414
Last major update 30-12-2016 - 21:59
Published 27-05-2015 - 06:59
Back to Top