Debian DLA-3065-1 : linux - LTS security update

high Nessus Plugin ID 162697

Language:

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3065 advisory.

- kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated. (CVE-2018-1108)

- Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel (CVE-2021-39713)

- A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of service (DOS) due to a deadlock problem. (CVE-2021-4149)

- A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

- A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

- A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation. (CVE-2022-1011)

- A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information. (CVE-2022-1353)

- A NULL pointer dereference flaw was found in the Linux kernel's X.25 set of standardized network protocols functionality in the way a user terminates their session using a simulated Ethernet card and continued usage of this connection. This flaw allows a local user to crash the system. (CVE-2022-1516)

- A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.
(CVE-2022-1734)

- Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. (CVE-2022-21123)

- Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. (CVE-2022-21125)

- Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. (CVE-2022-21166)

- Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042 (CVE-2022-23036, CVE-2022-23037, CVE-2022-23038, CVE-2022-23039, CVE-2022-23040, CVE-2022-23041, CVE-2022-23042)

- Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information. (CVE-2022-23960)

- drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.
(CVE-2022-24958)

- st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters. (CVE-2022-26490)

- An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)

- In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by the host for out-of-array access. (CVE-2022-27223)

- In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c. (CVE-2022-28356)

- ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
(CVE-2022-28390)

- The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

- net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free. (CVE-2022-32250)

- The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. (CVE-2022-32296)

- drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.
(CVE-2022-33981)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the linux packages.

For Debian 9 stretch, these problems have been fixed in version 4.9.320-2.

Plugin Details

Severity: High

ID: 162697

File Name: debian_DLA-3065.nasl

Version: 1.5

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 7/2/2022

Updated: 12/26/2022

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.4

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 6.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2022-32250

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 8.4

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

CVSS Score Source: CVE-2022-27223

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:linux-compiler-gcc-6-x86, p-cpe:/a:debian:debian_linux:libcpupower1, p-cpe:/a:debian:debian_linux:linux-image-4.9.0-18-686, p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-18-all, p-cpe:/a:debian:debian_linux:linux-image-4.9.0-18-rt-amd64, cpe:/o:debian:debian_linux:9.0, p-cpe:/a:debian:debian_linux:linux-doc-4.9, p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-18-armmp-lpae, p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-18-arm64, p-cpe:/a:debian:debian_linux:linux-image-4.9.0-18-rt-amd64-dbg, p-cpe:/a:debian:debian_linux:linux-image-4.9.0-18-arm64, p-cpe:/a:debian:debian_linux:linux-image-4.9.0-18-armmp-dbg, p-cpe:/a:debian:debian_linux:linux-manual-4.9, p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-18-rt-amd64, p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-18-armmp, p-cpe:/a:debian:debian_linux:usbip, p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-18-all-amd64, p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-18-686-pae, p-cpe:/a:debian:debian_linux:linux-image-4.9.0-18-armmp-lpae-dbg, p-cpe:/a:debian:debian_linux:linux-perf-4.9, p-cpe:/a:debian:debian_linux:linux-image-4.9.0-18-686-pae, p-cpe:/a:debian:debian_linux:linux-image-4.9.0-18-686-pae-dbg, p-cpe:/a:debian:debian_linux:linux-image-4.9.0-18-marvell, p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-18-686, p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-18-all-arm64, p-cpe:/a:debian:debian_linux:linux-compiler-gcc-6-arm, p-cpe:/a:debian:debian_linux:linux-image-4.9.0-18-amd64, p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-18-common-rt, p-cpe:/a:debian:debian_linux:libcpupower-dev, p-cpe:/a:debian:debian_linux:linux-image-4.9.0-18-rt-686-pae, p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-18-common, p-cpe:/a:debian:debian_linux:linux-image-4.9.0-18-rt-686-pae-dbg, p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-18-all-armhf, p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-18-amd64, p-cpe:/a:debian:debian_linux:linux-support-4.9.0-18, p-cpe:/a:debian:debian_linux:linux-image-4.9.0-18-marvell-dbg, p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-18-all-i386, p-cpe:/a:debian:debian_linux:linux-image-4.9.0-18-armmp, p-cpe:/a:debian:debian_linux:linux-kbuild-4.9, p-cpe:/a:debian:debian_linux:linux-libc-dev, p-cpe:/a:debian:debian_linux:linux-cpupower, p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-18-marvell, p-cpe:/a:debian:debian_linux:linux-image-4.9.0-18-armmp-lpae, p-cpe:/a:debian:debian_linux:linux-source-4.9, p-cpe:/a:debian:debian_linux:linux-image-4.9.0-18-amd64-dbg, p-cpe:/a:debian:debian_linux:hyperv-daemons, p-cpe:/a:debian:debian_linux:linux-image-4.9.0-18-686-dbg, p-cpe:/a:debian:debian_linux:libusbip-dev, p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-18-rt-686-pae, p-cpe:/a:debian:debian_linux:linux-image-4.9.0-18-arm64-dbg, p-cpe:/a:debian:debian_linux:linux-headers-4.9.0-18-all-armel

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/1/2022

Vulnerability Publication Date: 4/12/2018

Reference Information

CVE: CVE-2018-1108, CVE-2021-39713, CVE-2021-4149, CVE-2022-0494, CVE-2022-0812, CVE-2022-0854, CVE-2022-1011, CVE-2022-1012, CVE-2022-1016, CVE-2022-1198, CVE-2022-1199, CVE-2022-1353, CVE-2022-1516, CVE-2022-1729, CVE-2022-1734, CVE-2022-1974, CVE-2022-1975, CVE-2022-21123, CVE-2022-21125, CVE-2022-21166, CVE-2022-2153, CVE-2022-23036, CVE-2022-23037, CVE-2022-23038, CVE-2022-23039, CVE-2022-23040, CVE-2022-23041, CVE-2022-23042, CVE-2022-23960, CVE-2022-24958, CVE-2022-26490, CVE-2022-26966, CVE-2022-27223, CVE-2022-28356, CVE-2022-28390, CVE-2022-30594, CVE-2022-32250, CVE-2022-32296, CVE-2022-33981

Detections

Analytics