Synopsis: Important: kernel security, bug fix, and enhancement update
Advisory ID: SLSA-2017:1308-1
Issue Date: 2017-05-25
CVE Numbers: CVE-2016-8646
* It was found that the packet_set_ring() function of the Linux kernel’s
networking implementation did not properly validate certain block-size
data. A local attacker with CAP_NET_RAW capability could use this flaw to
trigger a buffer overflow, resulting in the crash of the system. Due to
the nature of the flaw, privilege escalation cannot be fully ruled out.
* Mounting a crafted EXT4 image read-only leads to an attacker controlled
memory corruption and SLAB-Out-of-Bounds reads. (CVE-2016-10208, Moderate)
* A flaw was found in the Linux kernel’s implementation of seq_file where
a local attacker could manipulate memory in the put() function pointer.
This could lead to memory corruption and possible privileged escalation.
* A vulnerability was found in the Linux kernel. An unprivileged local
user could trigger oops in shash_async_export() by attempting to force the
in-kernel hashing algorithms into decrypting an empty data set.
* It was reported that with Linux kernel, earlier than version v4.10-rc8,
an application may trigger a BUG_ON in sctp_wait_for_sndbuf if the socket
tx buffer is full, a thread is waiting on it to queue more data, and
meanwhile another thread peels off the association being used by the first
thread. (CVE-2017-5986, Moderate)
– Scientific Linux Development Team