Test ID:	1.3.6.1.4.1.25623.1.0.843373
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-3485-3)
Summary:	The remote host is missing an update for the 'linux-aws' package(s) announced via the USN-3485-3 advisory.
Description:	Summary: The remote host is missing an update for the 'linux-aws' package(s) announced via the USN-3485-3 advisory. Vulnerability Insight: It was discovered that a race condition existed in the ALSA subsystem of the Linux kernel when creating and deleting a port via ioctl(). A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15265) Eric Biggers discovered that the key management subsystem in the Linux kernel did not properly restrict adding a key that already exists but is uninstantiated. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15299) It was discovered that a race condition existed in the packet fanout implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15649) Eric Biggers discovered a race condition in the key management subsystem of the Linux kernel around keys in a negative state. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15951) Andrey Konovalov discovered a use-after-free vulnerability in the USB serial console driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16525) Andrey Konovalov discovered that the Ultra Wide Band driver in the Linux kernel did not properly check for an error condition. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16526) Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16527) Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel did not properly validate USB audio buffer descriptors. A physically proximate attacker could use this cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16529) Andrey Konovalov discovered that the USB unattached storage driver in the Linux kernel contained out-of-bounds error when handling alternative settings. A physically proximate attacker could use to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16530) Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB interface association descriptors. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16531) Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB HID descriptors. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16533) Andrey Konovalov discovered that the USB subsystem in the Linux ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'linux-aws' package(s) on Ubuntu 14.04. Solution: Please install the updated package(s). CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-15265 BugTraq ID: 101288 http://www.securityfocus.com/bid/101288 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=71105998845fb012937332fe2e806d443c09e026 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.8 https://bugzilla.suse.com/show_bug.cgi?id=1062520 https://github.com/torvalds/linux/commit/71105998845fb012937332fe2e806d443c09e026 https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 https://source.android.com/security/bulletin/2018-02-01 https://www.oracle.com/security-alerts/cpujul2020.html https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html http://mailman.alsa-project.org/pipermail/alsa-devel/2017-October/126292.html https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html http://www.openwall.com/lists/oss-security/2017/10/11/3 RedHat Security Advisories: RHSA-2018:0676 https://access.redhat.com/errata/RHSA-2018:0676 RedHat Security Advisories: RHSA-2018:1062 https://access.redhat.com/errata/RHSA-2018:1062 RedHat Security Advisories: RHSA-2018:1130 https://access.redhat.com/errata/RHSA-2018:1130 RedHat Security Advisories: RHSA-2018:1170 https://access.redhat.com/errata/RHSA-2018:1170 RedHat Security Advisories: RHSA-2018:2390 https://access.redhat.com/errata/RHSA-2018:2390 RedHat Security Advisories: RHSA-2018:3822 https://access.redhat.com/errata/RHSA-2018:3822 RedHat Security Advisories: RHSA-2018:3823 https://access.redhat.com/errata/RHSA-2018:3823 http://www.securitytracker.com/id/1039561 https://usn.ubuntu.com/3698-1/ https://usn.ubuntu.com/3698-2/ Common Vulnerability Exposure (CVE) ID: CVE-2017-15299 https://bugzilla.redhat.com/show_bug.cgi?id=1498016 https://marc.info/?t=150654188100001&r=1&w=2 https://marc.info/?t=150783958600011&r=1&w=2 https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1499828.html RedHat Security Advisories: RHSA-2018:0654 https://access.redhat.com/errata/RHSA-2018:0654 https://usn.ubuntu.com/3798-1/ https://usn.ubuntu.com/3798-2/ Common Vulnerability Exposure (CVE) ID: CVE-2017-15649 BugTraq ID: 101573 http://www.securityfocus.com/bid/101573 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=008ba2a13f2d04c947adc536d19debb8fe66f110 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4971613c1639d8e5f102c4e797c3bf8f83a5a69e http://patchwork.ozlabs.org/patch/813945/ http://patchwork.ozlabs.org/patch/818726/ http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.6 https://blogs.securiteam.com/index.php/archives/3484 https://github.com/torvalds/linux/commit/008ba2a13f2d04c947adc536d19debb8fe66f110 https://github.com/torvalds/linux/commit/4971613c1639d8e5f102c4e797c3bf8f83a5a69e RedHat Security Advisories: RHSA-2018:0151 https://access.redhat.com/errata/RHSA-2018:0151 RedHat Security Advisories: RHSA-2018:0152 https://access.redhat.com/errata/RHSA-2018:0152 RedHat Security Advisories: RHSA-2018:0181 https://access.redhat.com/errata/RHSA-2018:0181 https://usn.ubuntu.com/3754-1/ Common Vulnerability Exposure (CVE) ID: CVE-2017-15951 BugTraq ID: 101621 http://www.securityfocus.com/bid/101621 Common Vulnerability Exposure (CVE) ID: CVE-2017-16525 BugTraq ID: 102028 http://www.securityfocus.com/bid/102028 https://github.com/torvalds/linux/commit/299d7572e46f98534033a9e65973f13ad1ce9047 https://github.com/torvalds/linux/commit/bd998c2e0df0469707503023d50d46cf0b10c787 https://groups.google.com/d/msg/syzkaller/cMACrmo1x0k/4KhRoUgABAAJ https://usn.ubuntu.com/3583-1/ https://usn.ubuntu.com/3583-2/ Common Vulnerability Exposure (CVE) ID: CVE-2017-16526 Debian Security Information: DSA-4187 (Google Search) https://www.debian.org/security/2018/dsa-4187 https://github.com/torvalds/linux/commit/bbf26183b7a6236ba602f4d6a2f7cade35bba043 https://groups.google.com/d/msg/syzkaller/zROBxKXzHDk/5I6aZ3O2AgAJ https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html Common Vulnerability Exposure (CVE) ID: CVE-2017-16527 https://github.com/torvalds/linux/commit/124751d5e63c823092060074bd0abaae61aaa9c4 https://groups.google.com/d/msg/syzkaller/jf7GTr_g2CU/iVlLhMciCQAJ Common Vulnerability Exposure (CVE) ID: CVE-2017-16529 BugTraq ID: 103284 http://www.securityfocus.com/bid/103284 https://github.com/torvalds/linux/commit/bfc81a8bc18e3c4ba0cbaa7666ff76be2f998991 https://groups.google.com/d/msg/syzkaller/rDzv5RP_f2M/M5au06qmAwAJ Common Vulnerability Exposure (CVE) ID: CVE-2017-16530 https://github.com/torvalds/linux/commit/786de92b3cb26012d3d0f00ee37adf14527f35c4 https://groups.google.com/d/msg/syzkaller/pCswO77gRlM/VHuPOftgAwAJ Common Vulnerability Exposure (CVE) ID: CVE-2017-16531 BugTraq ID: 102025 http://www.securityfocus.com/bid/102025 https://github.com/torvalds/linux/commit/bd7a3fe770ebd8391d1c7d072ff88e9e76d063eb https://groups.google.com/d/msg/syzkaller/hP6L-m59m_8/Co2ouWeFAwAJ https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html Common Vulnerability Exposure (CVE) ID: CVE-2017-16533 BugTraq ID: 102026 http://www.securityfocus.com/bid/102026 https://github.com/torvalds/linux/commit/f043bfc98c193c284e2cd768fefabe18ac2fed9b https://groups.google.com/d/msg/syzkaller/CxkJ9QZgwlM/O3IOvAaGAwAJ Common Vulnerability Exposure (CVE) ID: CVE-2017-16534 https://github.com/torvalds/linux/commit/2e1c42391ff2556387b3cb6308b24f6f65619feb https://groups.google.com/d/msg/syzkaller/nXnjqI73uPo/6sUyq6kqAgAJ SuSE Security Announcement: SUSE-SU-2018:0011 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html Common Vulnerability Exposure (CVE) ID: CVE-2017-16535 BugTraq ID: 102022 http://www.securityfocus.com/bid/102022 https://github.com/torvalds/linux/commit/1c0edc3633b56000e18d82fc241e3995ca18a69e https://groups.google.com/d/msg/syzkaller/tzdz2fTB1K0/OvjIgLSTAgAJ
Copyright	Copyright (C) 2017 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.