{"id":"USN-3392-1","aliases":[],"status":"published","title":"linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon regression","description":"USN-3378-1 fixed vulnerabilities in the Linux kernel. Unfortunately, a\nregression was introduced that prevented conntrack from working\ncorrectly in some situations. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Fan Wu and Shixiong Zhao discovered a race condition between inotify events\n and vfs rename operations in the Linux kernel. An unprivileged local\n attacker could use this to cause a denial of service (system crash) or\n execute arbitrary code. (CVE-2017-7533)\n\n It was discovered that the Linux kernel did not properly restrict\n RLIMIT_STACK size. A local attacker could use this in conjunction with\n another vulnerability to possibly execute arbitrary code.\n (CVE-2017-1000365)\n\n 李强 discovered that the Virtio GPU driver in the Linux kernel did not\n properly free memory in some situations. A local attacker could use this to\n cause a denial of service (memory consumption). (CVE-2017-10810)\n\n 石磊 discovered that the RxRPC Kerberos 5 ticket handling code in the\n Linux kernel did not properly verify metadata. A remote attacker could use\n this to cause a denial of service (system crash) or possibly execute\n arbitrary code. (CVE-2017-7482)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2017-08-16T06:55:19Z","modified":"2026-04-22T09:37:56Z","fixes":[{"ecosystem":"Ubuntu:16.04:LTS","package":"linux","fixed_in":["4.4.0-92.115"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-aws","fixed_in":["4.4.0-1031.40"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-gke","fixed_in":["4.4.0-1027.27"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","fixed_in":["4.4.0-1070.78"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","fixed_in":["4.4.0-1072.77"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-92.115"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43","4.4.0-28.47","4.4.0-31.50","4.4.0-34.53","4.4.0-36.55","4.4.0-38.57","4.4.0-42.62","4.4.0-43.63","4.4.0-45.66","4.4.0-47.68","4.4.0-51.72","4.4.0-53.74","4.4.0-57.78","4.4.0-59.80","4.4.0-62.83","4.4.0-63.84","4.4.0-64.85","4.4.0-65.86","4.4.0-66.87","4.4.0-67.88","4.4.0-70.91","4.4.0-71.92","4.4.0-72.93","4.4.0-75.96","4.4.0-77.98","4.4.0-78.99","4.4.0-79.100","4.4.0-81.104","4.4.0-83.106","4.4.0-87.110","4.4.0-89.112","4.4.0-91.114"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1031.40"}]}],"versions":["4.4.0-1001.10","4.4.0-1003.12","4.4.0-1004.13","4.4.0-1007.16","4.4.0-1009.18","4.4.0-1011.20","4.4.0-1012.21","4.4.0-1013.22","4.4.0-1016.25","4.4.0-1017.26","4.4.0-1018.27","4.4.0-1020.29","4.4.0-1022.31","4.4.0-1026.35","4.4.0-1028.37","4.4.0-1030.39"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1027.27"}]}],"versions":["4.4.0-1003.3","4.4.0-1005.6","4.4.0-1006.6","4.4.0-1008.8","4.4.0-1009.9","4.4.0-1010.10","4.4.0-1012.12","4.4.0-1013.13","4.4.0-1014.14","4.4.0-1016.16","4.4.0-1018.18","4.4.0-1022.22","4.4.0-1024.24","4.4.0-1026.26"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1070.78"}]}],"versions":["4.2.0-1013.19","4.2.0-1014.21","4.3.0-1006.6","4.4.0-1003.4","4.4.0-1004.5","4.4.0-1009.10","4.4.0-1010.12","4.4.0-1010.13","4.4.0-1012.16","4.4.0-1016.22","4.4.0-1017.23","4.4.0-1019.25","4.4.0-1021.27","4.4.0-1023.29","4.4.0-1027.33","4.4.0-1029.36","4.4.0-1034.41","4.4.0-1038.45","4.4.0-1040.47","4.4.0-1042.49","4.4.0-1044.51","4.4.0-1046.53","4.4.0-1048.55","4.4.0-1050.57","4.4.0-1051.58","4.4.0-1052.59","4.4.0-1054.61","4.4.0-1055.62","4.4.0-1057.64","4.4.0-1059.67","4.4.0-1061.69","4.4.0-1065.73","4.4.0-1067.75","4.4.0-1069.77"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1072.77"}]}],"versions":["4.4.0-1012.12","4.4.0-1013.14","4.4.0-1013.15","4.4.0-1015.18","4.4.0-1019.22","4.4.0-1020.23","4.4.0-1022.25","4.4.0-1024.27","4.4.0-1026.29","4.4.0-1030.33","4.4.0-1032.36","4.4.0-1035.39","4.4.0-1039.43","4.4.0-1042.46","4.4.0-1044.48","4.4.0-1046.50","4.4.0-1047.51","4.4.0-1048.52","4.4.0-1050.54","4.4.0-1051.55","4.4.0-1053.57","4.4.0-1054.58","4.4.0-1055.59","4.4.0-1057.61","4.4.0-1058.62","4.4.0-1059.63","4.4.0-1061.66","4.4.0-1063.68","4.4.0-1067.72","4.4.0-1069.74","4.4.0-1071.76"]}],"references":[{"url":"https://ubuntu.com/security/notices/USN-3392-1","tags":["advisory"]},{"url":"https://bugs.launchpad.net/bugs/1709032","tags":["report"]}],"sources":{"osv":[{"id":"USN-3392-1","title":"linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon regression","description":"USN-3378-1 fixed vulnerabilities in the Linux kernel. Unfortunately, a\nregression was introduced that prevented conntrack from working\ncorrectly in some situations. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Fan Wu and Shixiong Zhao discovered a race condition between inotify events\n and vfs rename operations in the Linux kernel. An unprivileged local\n attacker could use this to cause a denial of service (system crash) or\n execute arbitrary code. (CVE-2017-7533)\n\n It was discovered that the Linux kernel did not properly restrict\n RLIMIT_STACK size. A local attacker could use this in conjunction with\n another vulnerability to possibly execute arbitrary code.\n (CVE-2017-1000365)\n\n 李强 discovered that the Virtio GPU driver in the Linux kernel did not\n properly free memory in some situations. A local attacker could use this to\n cause a denial of service (memory consumption). (CVE-2017-10810)\n\n 石磊 discovered that the RxRPC Kerberos 5 ticket handling code in the\n Linux kernel did not properly verify metadata. A remote attacker could use\n this to cause a denial of service (system crash) or possibly execute\n arbitrary code. (CVE-2017-7482)\n","status":"published","published":"2017-08-16T06:55:19Z","modified":"2026-04-22T09:37:56.981306Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}