| Description: | Summary:
The remote host is missing an update for the 'linux' package(s) announced via the USN-947-2 advisory.
Vulnerability Insight:
USN-947-1 fixed vulnerabilities in the Linux kernel. Fixes for
CVE-2010-0419 caused failures when using KVM in certain situations.
This update reverts that fix until a better solution can be found.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Linux kernel did not correctly handle memory
protection of the Virtual Dynamic Shared Object page when running
a 32-bit application on a 64-bit kernel. A local attacker could
exploit this to cause a denial of service. (Only affected Ubuntu 6.06
LTS.) (CVE-2009-4271)
It was discovered that the r8169 network driver did not correctly check
the size of Ethernet frames. A remote attacker could send specially
crafted traffic to crash the system, leading to a denial of service.
(CVE-2009-4537)
Wei Yongjun discovered that SCTP did not correctly validate certain
chunks. A remote attacker could send specially crafted traffic to
monopolize CPU resources, leading to a denial of service. (Only affected
Ubuntu 6.06 LTS.) (CVE-2010-0008)
It was discovered that KVM did not correctly limit certain privileged
IO accesses on x86. Processes in the guest OS with access to IO regions
could gain further privileges within the guest OS. (Did not affect Ubuntu
6.06 LTS.) (CVE-2010-0298, CVE-2010-0306, CVE-2010-0419)
Evgeniy Polyakov discovered that IPv6 did not correctly handle
certain TUN packets. A remote attacker could exploit this to crash
the system, leading to a denial of service. (Only affected Ubuntu 8.04
LTS.) (CVE-2010-0437)
Sachin Prabhu discovered that GFS2 did not correctly handle certain locks.
A local attacker with write access to a GFS2 filesystem could exploit
this to crash the system, leading to a denial of service. (CVE-2010-0727)
Jamie Strandboge discovered that network virtio in KVM did not correctly
handle certain high-traffic conditions. A remote attacker could exploit
this by sending specially crafted traffic to a guest OS, causing the
guest to crash, leading to a denial of service. (Only affected Ubuntu
8.04 LTS.) (CVE-2010-0741)
Marcus Meissner discovered that the USB subsystem did not correctly handle
certain error conditions. A local attacker with access to a USB device
could exploit this to read recently used kernel memory, leading to a
loss of privacy and potentially root privilege escalation. (CVE-2010-1083)
Neil Brown discovered that the Bluetooth subsystem did not correctly
handle large amounts of traffic. A physically proximate remote attacker
could exploit this by sending specially crafted traffic that would consume
all available system memory, leading to a denial of service. (Ubuntu
6.06 LTS and 10.04 LTS were not affected.) (CVE-2010-1084)
Jody Bruchon discovered that the sound driver for the AMD780V did not
correctly handle certain conditions. A local attacker with access to
this hardware could exploit the flaw to cause a ... [Please see the references for more information on the vulnerabilities]
Affected Software/OS:
'linux' package(s) on Ubuntu 10.04.
Solution:
Please install the updated package(s).
CVSS Score:
7.8
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C
|
