Withdrawn by the publisher.

The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced.

The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced.

kernel: aio: insufficient sanitization of head in aio_read_events_ring() kernel: block: floppy: privilege escalation via FDRAWCMD floppy ioctl command kernel: block: floppy: privilege escalation via FDRAWCMD floppy ioctl command kernel: net: potential information leak when ubuf backed skbs are skb_zerocopy()ied kernel: net: ping: refcount issue in ping_init_sock() function Kernel: filter: prevent nla extensions to peek beyond the end of the message Kernel: filter: prevent nla extensions to peek beyond the end of the message kernel: futex: pi futexes requeue issue

kernel: net: insufficient permision checks of netlink messages kernel: aio: insufficient sanitization of head in aio_read_events_ring() Kernel: filter: prevent nla extensions to peek beyond the end of the message Kernel: filter: prevent nla extensions to peek beyond the end of the message kernel: futex: pi futexes requeue issue kernel: DoS with syscall auditing Kernel: missing check during hugepage migration Kernel: target/rd: imformation leakage kernel: sctp: sk_ack_backlog wrap-around problem kernel: x86_64: ptrace: sysret to non-canonical address

Security update for Linux kernel

Affected: Ubuntu:14.04:LTS: linux

The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced.