Ubuntu USN-2335-1 Kernel Security Advisory (CVE-2014-3917/4027/4171)

Key Information: Vulnerability Advisory ID: USN-2335-1 Release Date: September 2, 2014 Version: Ubuntu 12.04 Vulnerability Description: - A vulnerability was found in the Linux kernel's audit subsystem when auditing certain system calls. A local attacker could potentially exploit this vulnerability to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS). (CVE-2014-3917) - An information disclosure vulnerability was discovered in the rd_mcp backend of the iSCSI target subsystem in the Linux kernel. A local user could potentially exploit this vulnerability to obtain sensitive information from ramdisk_mcp memory by leveraging SCSI initiators. (CVE-2014-4027) - Sasha Levin reported an issue with the Linux kernel's shared memory subsystem when using range notifications and hole filling. A local user could potentially exploit this vulnerability to cause a denial of service. (CVE-2014-4171) - An information disclosure was found in the control implementation of Advanced Linux Sound... Remediation Instructions: - A computer restart is required after a standard system update. For more information on how to obtain the fix, please refer to this link. - Due to unavoidable ABI changes, the kernel update has been assigned a new version number. Therefore, you are required to recompile and reinstall all third-party kernel modules that may have been installed. If you are using linux-restricted-modules, be sure to check for updates to this package to obtain modules compatible with the new kernel version. Unless you have manually removed the standard kernel meta-packages (such as linux-generic, linux-server, linux-powerpc), the standard system upgrade will automatically handle this. Recommended Upgrade Package Versions: - For Ubuntu 12.04 precise, update to linux-image-3.2.0-1452-omap 3.2.0-1452.72 CVE Numbers: CVE-2014-5077, CVE-2014-4667, CVE-2014-4656, CVE-2014-4655, CVE-2014-4654, CVE-2014-4653, CVE-2014-4652, CVE-2014-4171, CVE-2014-4027, CVE-2014-3917 Related Advisories: USN-2359-1, USN-2358-1, USN-2337-1, USN-2336-1, USN-2334-1, USN-2333-1, USN-2332-1, USN-2314-1, USN-2313-1, USN-2289-1

Goal Reached Thanks to every supporter — we hit 100%!

Ubuntu USN-2335-1 Kernel Security Advisory (CVE-2014-3917/4027/4171)