USN-2467-1

Dashboard / Vulnerabilities / USN-2467-1

USN-2467-1

Summary: linux-lts-utopic vulnerabilities

Details: A null pointer dereference flaw was discovered in the the Linux kernel's SCTP implementation when ASCONF is used. A remote attacker could exploit this flaw to cause a denial of service (system crash) via a malformed INIT chunk. (CVE-2014-7841) A race condition with MMIO and PIO transactions in the KVM (Kernel Virtual Machine) subsystem of the Linux kernel was discovered. A guest OS user could exploit this flaw to cause a denial of service (guest OS crash) via a specially crafted application. (CVE-2014-7842) Miloš Prchlík reported a flaw in how the ARM64 platform handles a single byte overflow in __clear_user. A local user could exploit this flaw to cause a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary. (CVE-2014-7843) A stack buffer overflow was discovered in the ioctl command handling for the Technotrend/Hauppauge USB DEC devices driver. A local user could exploit this flaw to cause a denial of service (system crash) or possibly gain privileges. (CVE-2014-8884)

References: https://ubuntu.com/security/notices/USN-2467-1, https://ubuntu.com/security/CVE-2014-7841, https://ubuntu.com/security/CVE-2014-7842, https://ubuntu.com/security/CVE-2014-7843, https://ubuntu.com/security/CVE-2014-8884