Withdrawn by the publisher.

It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_trusted_keys' upstream, by joining it as its session keyring. This allows root to bypass module signature verification by adding a new public key of its own devising to the keyring.

It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_trusted_keys' upstream, by joining it as its session keyring. This allows root to bypass module signature verification by adding a new public key of its own devising to the keyring.

Kernel: fs: VFS denial of service Kernel: fs: umount denial of service kernel: ext4 filesystem page fault race condition with fallocate call. kernel: crypto: GPF in lrw_crypt caused by null-deref kernel: Overflowing kernel mount table using shared bind mount kernel: Stack corruption while reading /proc/keys when gcc stack protector is enabled kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit kernel: a BUG() statement can be hit in net/ipv4/tcp_input.c kernel: Use after free in SCSI generic device interface Kernel: kvm: nVMX: uncaught software exceptions in L1 guest leads to DoS kernel: security: The built-in keyrings for security tokens can be joined as a session and then modified by the root user kernel: Memory leaks in xfs_attr_list.c error paths kernel: netlink: double-free in netlink_dump kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression) kernel: Kernel crash by spawning mcrypt(alg) with incompatible algorithm kernel: l2tp: Race condition in the L2TPv3 IP encapsulation feature kernel: race condition between direct and memory-mapped I/O in fs/xfs/xfs_aops.c Kernel: kvm: use after free in complete_emulated_mmio Kernel: kvm: page reference leakage in handle_vmon kernel: Null pointer dereference in search_keyring kernel: ping socket / AF_LLC connect() sin_family race kernel: S_ISGD is not cleared when setting posix ACLs in tmpfs (CVE-2016-7097 incomplete fix) kernel: ipv4: Invalid IP options could cause skb->dst drop kernel…

Kernel: fs: VFS denial of service Kernel: fs: umount denial of service kernel: ext4 filesystem page fault race condition with fallocate call. kernel: crypto: GPF in lrw_crypt caused by null-deref kernel: Overflowing kernel mount table using shared bind mount kernel: Stack corruption while reading /proc/keys when gcc stack protector is enabled kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit kernel: a BUG() statement can be hit in net/ipv4/tcp_input.c kernel: Use after free in SCSI generic device interface Kernel: kvm: nVMX: uncaught software exceptions in L1 guest leads to DoS kernel: security: The built-in keyrings for security tokens can be joined as a session and then modified by the root user kernel: Memory leaks in xfs_attr_list.c error paths kernel: netlink: double-free in netlink_dump kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression) kernel: Kernel crash by spawning mcrypt(alg) with incompatible algorithm kernel: l2tp: Race condition in the L2TPv3 IP encapsulation feature kernel: race condition between direct and memory-mapped I/O in fs/xfs/xfs_aops.c Kernel: kvm: use after free in complete_emulated_mmio Kernel: kvm: page reference leakage in handle_vmon kernel: Null pointer dereference in search_keyring kernel: ping socket / AF_LLC connect() sin_family race kernel: S_ISGD is not cleared when setting posix ACLs in tmpfs (CVE-2016-7097 incomplete fix) kernel: ipv4: Invalid IP options could cause skb->dst drop kernel…

Security update for the Linux Kernel

Affected: Ubuntu:14.04:LTS: linux, Ubuntu:14.04:LTS: linux-lts-xenial, Ubuntu:16.04:LTS: linux, Ubuntu:16.04:LTS: linux-aws, Ubuntu:16.04:LTS: linux-gke, Ubuntu:16.04:LTS: linux-hwe, Ubuntu:16.04:LTS: linux-raspi2, Ubuntu:16.04:LTS: linux-snapdragon, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-gcp and 16 more

It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_trusted_keys' upstream, by joining it as its session keyring. This allows root to bypass module signature verification by adding a new public key of its own devising to the keyring.