[USN-2379-1] Linux kernel vulnerabilities

Severity Medium

Affected Packages 9

CVEs 9

Several security issues were fixed in the kernel.

Steven Vittitoe reported multiple stack buffer overflows in Linux kernel's
magicmouse HID driver. A physically proximate attacker could exploit this
flaw to cause a denial of service (system crash) or possibly execute
arbitrary code via specially crafted devices. (CVE-2014-3181)

Ben Hawkes reported some off by one errors for report descriptors in the
Linux kernel's HID stack. A physically proximate attacker could exploit
these flaws to cause a denial of service (out-of-bounds write) via a
specially crafted device. (CVE-2014-3184)

Several bounds check flaws allowing for buffer overflows were discovered in
the Linux kernel's Whiteheat USB serial driver. A physically proximate
attacker could exploit these flaws to cause a denial of service (system
crash) via a specially crafted device. (CVE-2014-3185)

Steven Vittitoe reported a buffer overflow in the Linux kernel's PicoLCD
HID device driver. A physically proximate attacker could exploit this flaw
to cause a denial of service (system crash) or possibly execute arbitrary
code via a specially craft device. (CVE-2014-3186)

A flaw was discovered in the Linux kernel's associative-array garbage
collection implementation. A local user could exploit this flaw to cause a
denial of service (system crash) or possibly have other unspecified impact
by using keyctl operations. (CVE-2014-3631)

A flaw was discovered in the Linux kernel's UDF filesystem (used on some
CD-ROMs and DVDs) when processing indirect ICBs. An attacker who can cause
CD, DVD or image file with a specially crafted inode to be mounted can
cause a denial of service (infinite loop or stack consumption).
(CVE-2014-6410)

James Eckersall discovered a buffer overflow in the Ceph filesystem in the
Linux kernel. A remote attacker could exploit this flaw to cause a denial
of service (memory consumption and panic) or possibly have other
unspecified impact via a long unencrypted auth ticket. (CVE-2014-6416)

James Eckersall discovered a flaw in the handling of memory allocation
failures in the Ceph filesystem. A remote attacker could exploit this flaw
to cause a denial of service (system crash) or possibly have unspecified
other impact. (CVE-2014-6417)

James Eckersall discovered a flaw in how the Ceph filesystem validates auth
replies. A remote attacker could exploit this flaw to cause a denial of
service (system crash) or possibly have other unspecified impact.
(CVE-2014-6418)

Package	Affected Version
pkg:deb/ubuntu/linux-image-extra-3.13.0-37-generic?distro=trusty	< 3.13.0-37.64
pkg:deb/ubuntu/linux-image-3.13.0-37-powerpc64-smp?distro=trusty	< 3.13.0-37.64
pkg:deb/ubuntu/linux-image-3.13.0-37-powerpc64-emb?distro=trusty	< 3.13.0-37.64
pkg:deb/ubuntu/linux-image-3.13.0-37-powerpc-smp?distro=trusty	< 3.13.0-37.64
pkg:deb/ubuntu/linux-image-3.13.0-37-powerpc-e500mc?distro=trusty	< 3.13.0-37.64
pkg:deb/ubuntu/linux-image-3.13.0-37-powerpc-e500?distro=trusty	< 3.13.0-37.64
pkg:deb/ubuntu/linux-image-3.13.0-37-lowlatency?distro=trusty	< 3.13.0-37.64
pkg:deb/ubuntu/linux-image-3.13.0-37-generic?distro=trusty	< 3.13.0-37.64
pkg:deb/ubuntu/linux-image-3.13.0-37-generic-lpae?distro=trusty	< 3.13.0-37.64

ID

USN-2379-1

Severity

medium

URL

https://ubuntu.com/security/notices/USN-2379-1

Published

2014-10-09T11:00:07
(10 years ago)

Modified

2014-10-09T11:00:07
(10 years ago)

Other Advisories

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform
Affected	pkg:deb/ubuntu/linux-image-extra-3.13.0-37-generic?distro=trusty	ubuntu	linux-image-extra-3.13.0-37-generic	< 3.13.0-37.64	trusty
Affected	pkg:deb/ubuntu/linux-image-3.13.0-37-powerpc64-smp?distro=trusty	ubuntu	linux-image-3.13.0-37-powerpc64-smp	< 3.13.0-37.64	trusty
Affected	pkg:deb/ubuntu/linux-image-3.13.0-37-powerpc64-emb?distro=trusty	ubuntu	linux-image-3.13.0-37-powerpc64-emb	< 3.13.0-37.64	trusty
Affected	pkg:deb/ubuntu/linux-image-3.13.0-37-powerpc-smp?distro=trusty	ubuntu	linux-image-3.13.0-37-powerpc-smp	< 3.13.0-37.64	trusty
Affected	pkg:deb/ubuntu/linux-image-3.13.0-37-powerpc-e500mc?distro=trusty	ubuntu	linux-image-3.13.0-37-powerpc-e500mc	< 3.13.0-37.64	trusty
Affected	pkg:deb/ubuntu/linux-image-3.13.0-37-powerpc-e500?distro=trusty	ubuntu	linux-image-3.13.0-37-powerpc-e500	< 3.13.0-37.64	trusty
Affected	pkg:deb/ubuntu/linux-image-3.13.0-37-lowlatency?distro=trusty	ubuntu	linux-image-3.13.0-37-lowlatency	< 3.13.0-37.64	trusty
Affected	pkg:deb/ubuntu/linux-image-3.13.0-37-generic?distro=trusty	ubuntu	linux-image-3.13.0-37-generic	< 3.13.0-37.64	trusty
Affected	pkg:deb/ubuntu/linux-image-3.13.0-37-generic-lpae?distro=trusty	ubuntu	linux-image-3.13.0-37-generic-lpae	< 3.13.0-37.64	trusty

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date