Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2290-1)

medium Nessus Plugin ID 76569

Synopsis

The remote Ubuntu host is missing one or more security updates.

Description

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2290-1 advisory.

- The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call.
(CVE-2014-1739)

- The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr and
__skb_get_nlattr_nest functions before the vulnerability was announced. (CVE-2014-3144)

- The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users to cause a denial of service (over-read and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced.
(CVE-2014-3145)

- The Linux kernel through 3.14.5 does not properly consider the presence of hugetlb entries, which allows local users to cause a denial of service (memory corruption or system crash) by accessing certain memory locations, as demonstrated by triggering a race condition via numa_maps read operations during hugepage migration, related to fs/proc/task_mmu.c and mm/mempolicy.c. (CVE-2014-3940)

- Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4_uncompress function in lib/lz4/lz4_decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run that would be improperly handled by programs not complying with an API limitation, a different vulnerability than CVE-2014-4715. (CVE-2014-4611)

- The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.
(CVE-2014-4943)

- The net_get_random_once implementation in net/core/utils.c in the Linux kernel 3.13.x and 3.14.x before 3.14.5 on certain Intel processors does not perform the intended slow-path operation to initialize random seeds, which makes it easier for remote attackers to spoof or disrupt IP communication by leveraging the predictability of TCP sequence numbers, TCP and UDP port numbers, and IP ID values. (CVE-2014-7284)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel package.

See Also

https://ubuntu.com/security/notices/USN-2290-1

Plugin Details

Severity: Medium

ID: 76569

File Name: ubuntu_USN-2290-1.nasl

Version: 1.23

Type: local

Agent: unix

Published: 7/17/2014

Updated: 1/9/2024

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: Medium

Base Score: 6.9

Temporal Score: 6

Vector: CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2014-4943

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 5.3

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

CVSS Score Source: CVE-2014-3144

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:linux-image-3.13.0-32-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-3.13.0-32-generic-lpae, p-cpe:/a:canonical:ubuntu_linux:linux-image-3.13.0-32-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-image-3.13.0-32-powerpc-e500, p-cpe:/a:canonical:ubuntu_linux:linux-image-3.13.0-32-powerpc-e500mc, p-cpe:/a:canonical:ubuntu_linux:linux-image-3.13.0-32-powerpc-smp, p-cpe:/a:canonical:ubuntu_linux:linux-image-3.13.0-32-powerpc64-emb, p-cpe:/a:canonical:ubuntu_linux:linux-image-3.13.0-32-powerpc64-smp, cpe:/o:canonical:ubuntu_linux:14.04:-:lts

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/16/2014

Vulnerability Publication Date: 5/11/2014

Exploitable With

CANVAS (CANVAS)

Reference Information

CVE: CVE-2014-1739, CVE-2014-3144, CVE-2014-3145, CVE-2014-3940, CVE-2014-4611, CVE-2014-4943, CVE-2014-7284

BID: 67309, 67321, 67786, 68048, 68214, 68218, 68683

USN: 2290-1