Debian DSA-4120-1 : linux - security update (Meltdown) (Spectre)

high Nessus Plugin ID 106955

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

- CVE-2017-5715 Multiple researchers have discovered a vulnerability in various processors supporting speculative execution, enabling an attacker controlling an unprivileged process to read memory from arbitrary addresses, including from the kernel and all other processes running on the system.

This specific attack has been named Spectre variant 2 (branch target injection) and is mitigated in the Linux kernel for the Intel x86-64 architecture by using the 'retpoline' compiler feature which allows indirect branches to be isolated from speculative execution.

- CVE-2017-5754 Multiple researchers have discovered a vulnerability in Intel processors, enabling an attacker controlling an unprivileged process to read memory from arbitrary addresses, including from the kernel and all other processes running on the system.

This specific attack has been named Meltdown and is addressed in the Linux kernel on the powerpc/ppc64el architectures by flushing the L1 data cache on exit from kernel mode to user mode (or from hypervisor to kernel).

This works on Power7, Power8 and Power9 processors.

- CVE-2017-13166 A bug in the 32-bit compatibility layer of the v4l2 IOCTL handling code has been found. Memory protections ensuring user-provided buffers always point to userland memory were disabled, allowing destination address to be in kernel space. This bug could be exploited by an attacker to overwrite kernel memory from an unprivileged userland process, leading to privilege escalation.

- CVE-2018-5750 An information leak has been found in the Linux kernel.
The acpi_smbus_hc_add() prints a kernel address in the kernel log at every boot, which could be used by an attacker on the system to defeat kernel ASLR.

Additionnaly to those vulnerability, some mitigations for CVE-2017-5753 are included in this release.

- CVE-2017-5753 Multiple researchers have discovered a vulnerability in various processors supporting speculative execution, enabling an attacker controlling an unprivileged process to read memory from arbitrary addresses, including from the kernel and all other processes running on the system.

This specific attack has been named Spectre variant 1 (bounds-check bypass) and is mitigated in the Linux kernel architecture by identifying vulnerable code sections (array bounds checking followed by array access) and replacing the array access with the speculation-safe array_index_nospec() function.

More use sites will be added over time.

Solution

Upgrade the linux packages.

For the stable distribution (stretch), these problems have been fixed in version 4.9.82-1+deb9u2.

Plugin Details

Severity: High

ID: 106955

File Name: debian_DSA-4120.nasl

Version: 3.6

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 2/23/2018

Updated: 7/15/2019

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.1

CVSS v2

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 4.1

Vector: CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:N

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7.5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:linux, cpe:/o:debian:debian_linux:9.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/22/2018

Vulnerability Publication Date: 12/6/2017

Reference Information

CVE: CVE-2017-13166, CVE-2017-5715, CVE-2017-5754, CVE-2018-5750

DSA: 4120

IAVA: 2018-A-0019, 2018-A-0020

Detections

Analytics