Summary
Jan H. Schönherr discovered that the Xen subsystem did not properly handle
block IO merges correctly in some situations. An attacker in a guest vm
could use this to cause a denial of service (host crash) or possibly gain
administrative privileges in the host. (CVE-2017-12134)
Andrey Konovalov discovered that a divide-by-zero error existed in the TCP
stack implementation in the Linux kernel. A local attacker could use this
to cause a denial of service (system crash). (CVE-2017-14106)
Otto Ebeling discovered that the memory manager in the Linux kernel did not
properly check the effective UID in some situations. A local attacker could
use this to expose sensitive information. (CVE-2017-14140)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | linux | 4.4.0-97.120 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-aws | 4.4.0-1038.47 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-gke | 4.4.0-1032.32 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-kvm | 4.4.0-1008.13 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-raspi2 | 4.4.0-1075.83 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-snapdragon | 4.4.0-1077.82 |
Vulnerabilities 3
-
Unscored —
The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt blo…
-
Unscored —
The tcp_disconnect function in net/ipv4/tcp.c in the Linux kernel before 4.12 allows local users to cause a denial of s…
-
Unscored —
The move_pages system call in mm/migrate.c in the Linux kernel before 4.12.9 doesn't check the effective uid of the tar…