{"id":"USN-3392-2","aliases":[],"status":"published","title":"linux-lts-xenial regression","description":"USN-3392-1 fixed a regression in the Linux kernel for Ubuntu 16.04 LTS.\nThis update provides the corresponding updates for the Linux Hardware\nEnablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS.\n\nUSN-3378-2 fixed vulnerabilities in the Linux Hardware Enablement\nkernel. Unfortunately, a regression was introduced that prevented\nconntrack from working correctly in some situations. This update\nfixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Fan Wu and Shixiong Zhao discovered a race condition between inotify events\n and vfs rename operations in the Linux kernel. An unprivileged local\n attacker could use this to cause a denial of service (system crash) or\n execute arbitrary code. (CVE-2017-7533)\n\n It was discovered that the Linux kernel did not properly restrict\n RLIMIT_STACK size. A local attacker could use this in conjunction with\n another vulnerability to possibly execute arbitrary code.\n (CVE-2017-1000365)\n\n 李强 discovered that the Virtio GPU driver in the Linux kernel did not\n properly free memory in some situations. A local attacker could use this to\n cause a denial of service (memory consumption). (CVE-2017-10810)\n\n 石磊 discovered that the RxRPC Kerberos 5 ticket handling code in the\n Linux kernel did not properly verify metadata. A remote attacker could use\n this to cause a denial of service (system crash) or possibly execute\n arbitrary code. (CVE-2017-7482)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2017-08-16T06:43:55Z","modified":"2026-02-10T04:41:11Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","fixed_in":["4.4.0-92.115~14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-92.115~14.04.1"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1","4.4.0-28.47~14.04.1","4.4.0-31.50~14.04.1","4.4.0-34.53~14.04.1","4.4.0-36.55~14.04.1","4.4.0-38.57~14.04.1","4.4.0-42.62~14.04.1","4.4.0-45.66~14.04.1","4.4.0-47.68~14.04.1","4.4.0-51.72~14.04.1","4.4.0-53.74~14.04.1","4.4.0-57.78~14.04.1","4.4.0-59.80~14.04.1","4.4.0-62.83~14.04.1","4.4.0-63.84~14.04.2","4.4.0-64.85~14.04.1","4.4.0-66.87~14.04.1","4.4.0-67.88~14.04.1","4.4.0-70.91~14.04.1","4.4.0-71.92~14.04.1","4.4.0-72.93~14.04.1","4.4.0-75.96~14.04.1","4.4.0-78.99~14.04.2","4.4.0-79.100~14.04.1","4.4.0-81.104~14.04.1","4.4.0-83.106~14.04.1","4.4.0-87.110~14.04.1","4.4.0-89.112~14.04.1","4.4.0-91.114~14.04.1"]}],"references":[{"url":"https://ubuntu.com/security/notices/USN-3392-2","tags":["advisory"]},{"url":"https://bugs.launchpad.net/bugs/1709032","tags":["report"]}],"sources":{"osv":[{"id":"USN-3392-2","title":"linux-lts-xenial regression","description":"USN-3392-1 fixed a regression in the Linux kernel for Ubuntu 16.04 LTS.\nThis update provides the corresponding updates for the Linux Hardware\nEnablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS.\n\nUSN-3378-2 fixed vulnerabilities in the Linux Hardware Enablement\nkernel. Unfortunately, a regression was introduced that prevented\nconntrack from working correctly in some situations. This update\nfixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Fan Wu and Shixiong Zhao discovered a race condition between inotify events\n and vfs rename operations in the Linux kernel. An unprivileged local\n attacker could use this to cause a denial of service (system crash) or\n execute arbitrary code. (CVE-2017-7533)\n\n It was discovered that the Linux kernel did not properly restrict\n RLIMIT_STACK size. A local attacker could use this in conjunction with\n another vulnerability to possibly execute arbitrary code.\n (CVE-2017-1000365)\n\n 李强 discovered that the Virtio GPU driver in the Linux kernel did not\n properly free memory in some situations. A local attacker could use this to\n cause a denial of service (memory consumption). (CVE-2017-10810)\n\n 石磊 discovered that the RxRPC Kerberos 5 ticket handling code in the\n Linux kernel did not properly verify metadata. A remote attacker could use\n this to cause a denial of service (system crash) or possibly execute\n arbitrary code. (CVE-2017-7482)\n","status":"published","published":"2017-08-16T06:43:55Z","modified":"2026-02-10T04:41:11Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}