Correção do kernel

Mauriciodez
(usa Debian)

Enviado em 22/02/2018 - 13:34h

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA512



- -------------------------------------------------------------------------

Debian Security Advisory DSA-4120-1                   security@debian.org

https://www.debian.org/security/                        Yves-Alexis Perez

February 22, 2018                     https://www.debian.org/security/faq

- -------------------------------------------------------------------------



Package        : linux

CVE ID         : CVE-2017-5715 CVE-2017-5754 CVE-2017-13166 CVE-2018-5750



Several vulnerabilities have been discovered in the Linux kernel that may

lead to a privilege escalation, denial of service or information leaks.



CVE-2017-5715



    Multiple researchers have discovered a vulnerability in various

    processors supporting speculative execution, enabling an attacker

    controlling an unprivileged process to read memory from arbitrary

    addresses, including from the kernel and all other processes running on

    the system.



    This specific attack has been named Spectre variant 2 (branch target

    injection) and is mitigated in the Linux kernel for the Intel x86-64

    architecture by using the 'retpoline' compiler feature which allows

    indirect branches to be isolated from speculative execution.



CVE-2017-5754



    Multiple researchers have discovered a vulnerability in Intel

    processors, enabling an attacker controlling an unprivileged process to

    read memory from arbitrary addresses, including from the kernel and all

    other processes running on the system.



    This specific attack has been named Meltdown and is addressed in the

    Linux kernel on the powerpc/ppc64el architectures by flushing the L1

    data cache on exit from kernel mode to user mode (or from hypervisor to

    kernel).

    

    This works on Power7, Power8 and Power9 processors.



CVE-2017-13166



    A bug in the 32-bit compatibility layer of the v4l2 IOCTL handling code

    has been found. Memory protections ensuring user-provided buffers always

    point to userland memory were disabled, allowing . This bug could be

    exploited by an attacker to overwrite kernel memory from an unprivileged

    userland process, leading to privilege escalation.



CVE-2018-5750



    An information leak has been found in the Linux kernel. The

    acpi_smbus_hc_add() prints a kernel address in the kernel log at every

    boot, which could be used by an attacker on the system to defeat kernel

    ASLR.



Additionnaly to those vulnerability, some mitigations for CVE-2017-5753 are

included in this release.



CVE-2017-5753



    Multiple researchers have discovered a vulnerability in various

    processors supporting speculative execution, enabling an attacker

    controlling an unprivileged process to read memory from arbitrary

    addresses, including from the kernel and all other processes running on

    the system.



    This specific attack has been named Spectre variant 1 (bounds-check

    bypass) and is mitigated in the Linux kernel architecture by identifying

    vulnerable code sections (array bounds checking followed by array

    access) and replacing the array access with the speculation-safe

    array_index_nospec() function.



    More use sites will be added over time.



For the stable distribution (stretch), these problems have been fixed in

version 4.9.82-1+deb9u2.



We recommend that you upgrade your linux packages.



For the detailed security status of linux please refer to

its security tracker page at:

https://security-tracker.debian.org/tracker/linux



Further information about Debian Security Advisories, how to apply

these updates to your system and frequently asked questions can be

found at: https://www.debian.org/security/



Mailing list: debian-security-announce@lists.debian.org

-----BEGIN PGP SIGNATURE-----



iQEzBAEBCgAdFiEE8vi34Qgfo83x35gF3rYcyPpXRFsFAlqO5kYACgkQ3rYcyPpX

RFtjkgf9HK7sq/xNOFjZsc3iaVNdzDhDEth8ql/Q9WsbDP9JmlrwmlTsD/QAgXgx

m9zIIJzyI9Dry60bVvYZHFrtYhQXX5zp9DYa89oinHv+1UxzaYHTHsNoh326k86n

QUcDLYe2+JJgi/2KjLqfFfa5zgMqUNj3C6iBDezs0tCfE/QZAmAX7aA7A3mTJYLB

3v2tSoEeW0fb9M5Ic2QHJD1TW6NU+j6zaUeJRyhj7lthmyOcNxwTIrt2CswDnLUI

tCMtzdce6OWAW5xXQxHwzzf5+vRvmm/f+wM2V3WTcA1Q0tfA5cZGFe2SMOhyGKtf

KG1ziLYIY0OdCtdxj0K/wEzpe6cikg==

=B81o

-----END PGP SIGNATURE-----