Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that changes socket state may race with safety checks in packet_set_ring. Previously with PACKET_VERSION. This time with PACKET_RESERVE. The solution is similar: lock the socket for the update. This issue may be exploitable, we did not investigate further. As this issue affects PF_PACKET sockets, it requires CAP_NET_RAW in the process namespace. But note that with user namespaces enabled, any process can create a namespace in which it has CAP_NET_RAW.

Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that changes socket state may race with safety checks in packet_set_ring. Previously with PACKET_VERSION. This time with PACKET_RESERVE. The solution is similar: lock the socket for the update. This issue may be exploitable, we did not investigate further. As this issue affects PF_PACKET sockets, it requires CAP_NET_RAW in the process namespace. But note that with user namespaces enabled, any process can create a namespace in which it has CAP_NET_RAW.

kernel: Out-of-bounds heap access in xfrm kernel: Possible heap buffer overflow in brcmf_cfg80211_mgmt_tx() kernel: Integer overflow in ip6_find_1stfragopt() causes infinite loop kernel: Out of bounds read in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() in SCTP stack kernel: Use-after-free in sys_mq_notify() kernel: Divide-by-zero in __tcp_select_window kernel: xfs: unprivileged user kernel oops kernel: Heap out-of-bounds read in AF_PACKET sockets kernel: Exploitable memory corruption due to UFO to non-UFO path switch

kernel: net: Out of bounds stack read in memcpy_fromiovec kernel: Out-of-bounds heap access in xfrm kernel: Possible heap buffer overflow in brcmf_cfg80211_mgmt_tx() kernel: Integer overflow in ip6_find_1stfragopt() causes infinite loop kernel: Out of bounds read in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() in SCTP stack kernel: Use-after-free in sys_mq_notify() kernel: Divide-by-zero in __tcp_select_window kernel: Heap out-of-bounds read in AF_PACKET sockets kernel: Exploitable memory corruption due to UFO to non-UFO path switch

Security update for the Linux Kernel

Affected: Ubuntu:14.04:LTS: linux, Ubuntu:14.04:LTS: linux-lts-xenial, Ubuntu:16.04:LTS: linux, Ubuntu:16.04:LTS: linux-aws, Ubuntu:16.04:LTS: linux-gke, Ubuntu:16.04:LTS: linux-hwe, Ubuntu:16.04:LTS: linux-raspi2, Ubuntu:16.04:LTS: linux-snapdragon, Ubuntu:20.04:LTS: linux-azure-fde, Ubuntu:20.04:LTS: linux-gke and 6 more

Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that changes socket state may race with safety checks in packet_set_ring. Previously with PACKET_VERSION. This time with PACKET_RESERVE. The solution is similar: lock the socket for the update. This issue may be exploitable, we did not investigate further. As this issue affects PF_PACKET sockets, it requires CAP_NET_RAW in the process namespace. But note that with user namespaces enabled, any process can create a namespace in which it has CAP_NET_RAW.

Ein lokaler Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um beliebigen Programmcode mit Administratorrechten oder den Privilegien des angegriffenen Dienstes auszuführen oder einen Denial of Service Zustand herbeizuführen.