CVE-2018-6412

In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands.

This kernel update is based on the upstream 4.14.50 and fixes at least the following security issues:

In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands (CVE-2018-6412).

The kvm functions that were used in the emulation of fxrstor, fxsave, sgdt and sidt were originally meant for task switching, and as such they did not check privilege levels. This allowed guest userspace to guest kernel write (CVE-2018-10853).

In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local attackers could cause L1 KVM guests to VMEXIT, potentially allowing privilege escalations and denial of service attacks due to lack of checking of CPL (CVE-2018-12904).

WireGuard has been updated to 0.0.20180613.

For other fixes in this update, see the referenced changelogs.

This kernel-tmb update is based on the upstream 4.14.62 and fixes at least the following security issues:

kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest (CVE-2018-1087).

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file (CVE-2018-1118).

Security researchers from FICORA have identified a remote denial of service attack against the Linux kernel caused by inefficient implementation of TCP segment reassembly, named "SegmentSmack". A remote attacker could consume a lot of CPU resources in the kernel networking stack with just a low bandwidth or single host attack by using lots of small TCP segments packets. Usually large botnets are needed for similar effect. The rate needed for this denial of service attack to be effective is several magnitudes lower than the usual packet processing capability of the machine, as the attack exploits worst case behaviour of existing algorithms (CVE-2018-5390). In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands (CVE-2018-6412).

In some circumstances, some operating systems or hypervisors may not expect or properly handle an Intel architecture hardware debug exception. The error appears to be due to developer interpretation of existing documentation for certain Intel architecture interrupt/exception instructions, namely MOV SS and POP SS. An authenticated attacker may be able to read sensitive data in memory or control low-level operating system functions (CVE-2018-8897).

Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image (CVE-2018-10840).

The kvm functions that were used in the emulation of fxrstor, fxsave, sgdt and sidt were originally meant for task switching, and as such they did not check privilege levels. This allowed guest userspace to guest kernel write (CVE-2018-10853).

A flaw was found in Linux kernel ext4 File System. A use-after-free in ext4_ext_remove_space() when mounting and operating a crafted ext4 image (CVE-2018-10876).

Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image (CVE-2018-10877).

A flaw was found in Linux kernel ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and so a denial of service or possibly unspecified other impact by when renaming a file in a crafted ext4 filesystem image (CVE-2018-10879).

A flaw was found in Linux kernel ext4 filesystem code. A stack-out-of-bounds write in ext4_update_inline_data() is possible when mounting and writing to a crafted ext4 image. An attacker could use this to cause a system crash and a denial of service (CVE-2018-10880).

A flaw was found in Linux kernel ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function and so a denial of service and a system crash by mounting and operating on a crafted ext4 filesystem image (CVE-2018-10881).

A flaw was…

This kernel-linus update is based on the upstream 4.14.62 and fixes at least the following security issues:

kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest (CVE-2018-1087).

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file (CVE-2018-1118).

Security researchers from FICORA have identified a remote denial of service attack against the Linux kernel caused by inefficient implementation of TCP segment reassembly, named "SegmentSmack". A remote attacker could consume a lot of CPU resources in the kernel networking stack with just a low bandwidth or single host attack by using lots of small TCP segments packets. Usually large botnets are needed for similar effect. The rate needed for this denial of service attack to be effective is several magnitudes lower than the usual packet processing capability of the machine, as the attack exploits worst case behaviour of existing algorithms (CVE-2018-5390). In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands (CVE-2018-6412).

In some circumstances, some operating systems or hypervisors may not expect or properly handle an Intel architecture hardware debug exception. The error appears to be due to developer interpretation of existing documentation for certain Intel architecture interrupt/exception instructions, namely MOV SS and POP SS. An authenticated attacker may be able to read sensitive data in memory or control low-level operating system functions (CVE-2018-8897).

Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image (CVE-2018-10840).

The kvm functions that were used in the emulation of fxrstor, fxsave, sgdt and sidt were originally meant for task switching, and as such they did not check privilege levels. This allowed guest userspace to guest kernel write (CVE-2018-10853).

A flaw was found in Linux kernel ext4 File System. A use-after-free in ext4_ext_remove_space() when mounting and operating a crafted ext4 image (CVE-2018-10876).

Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image (CVE-2018-10877).

A flaw was found in Linux kernel ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and so a denial of service or possibly unspecified other impact by when renaming a file in a crafted ext4 filesystem image (CVE-2018-10879).

A flaw was found in Linux kernel ext4 filesystem code. A stack-out-of-bounds write in ext4_update_inline_data() is possible when mounting and writing to a crafted ext4 image. An attacker could use this to cause a system crash and a denial of service (CVE-2018-10880).

A flaw was found in Linux kernel ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function and so a denial of service and a system crash by mounting and operating on a crafted ext4 filesystem image (CVE-2018-10881).

A flaw was…