The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.5.3 does not check whether a slot is a leaf, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and out-of-bounds read) via an application that uses associative-array data structures, as demonstrated by the keyutils test suite.

The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.5.3 does not check whether a slot is a leaf, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and out-of-bounds read) via an application that uses associative-array data structures, as demonstrated by the keyutils test suite.

kernel: File descriptors passed over unix sockets are not properly accounted kernel: Information leak when truncating of compressed/inlined extents on BTRFS kernel: IPv6 connect causes DoS via NULL pointer dereference kernel: when NFSv4 migration is executed, kernel oops occurs at NFS client kernel: CXGB3: Logic bug in return code handling prematurely frees key structures causing Use after free or kernel panic. kernel: incorrect restoration of machine specific registers from userspace kernel: incorrect restoration of machine specific registers from userspace kernel: NULL dereference in RFCOMM bind callback kernel: Kernel panic and system lockup by triggering BUG_ON() in public_key_verify_signature() kernel: race condition in the TLB flush logic kernel: Kernel memory leakage to ethernet frames due to buffer overflow in ethernet drivers kernel: double-free in usb-audio triggered by invalid USB descriptor kernel: pipe: limit the per-user amount of pages allocated in pipes kernel: Infinite loop vulnerability in KVM kernel: Null pointer dereference in trace_writeback_dirty_page() kernel: ipv4: denial of service when destroying a network interface kernel: ACPI table override allowed when securelevel is enabled kernel: use-after-free via crafted IPV6 sendmsg for raw / tcp / udp / l2tp sockets. kernel: Information leak in Linux sound module in timer.c kernel: Information leak in events in timer.c kernel: Slave being first propagated copy causes oops in propagate_mnt kernel: Use afte…

Security update for the Linux Kernel

Affected: Ubuntu:14.04:LTS: linux, Ubuntu:14.04:LTS: linux-lts-vivid, Ubuntu:14.04:LTS: linux-lts-xenial, Ubuntu:16.04:LTS: linux, Ubuntu:16.04:LTS: linux-raspi2, Ubuntu:16.04:LTS: linux-snapdragon, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-hwe, Ubuntu:18.04:LTS: linux-hwe-edge and 17 more

The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.5.3 does not check whether a slot is a leaf, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and out-of-bounds read) via an application that uses associative-array data structures, as demonstrated by the keyutils test suite.