USN-2690-1

Dashboard / Vulnerabilities / USN-2690-1

USN-2690-1

Summary: linux-lts-vivid vulnerabilities

Details: Andy Lutomirski discovered a flaw in the Linux kernel's handling of nested NMIs (non-maskable interrupts). An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or potentially escalate their privileges. (CVE-2015-3290) Colin King discovered a flaw in the add_key function of the Linux kernel's keyring subsystem. A local user could exploit this flaw to cause a denial of service (memory exhaustion). (CVE-2015-1333) Andy Lutomirski discovered a flaw that allows user to cause the Linux kernel to ignore some NMIs (non-maskable interrupts). A local unprivileged user could exploit this flaw to potentially cause the system to miss important NMIs resulting in unspecified effects. (CVE-2015-3291) Andy Lutomirski and Petr Matousek discovered that an NMI (non-maskable interrupt) that interrupts userspace and encounters an IRET fault is incorrectly handled by the Linux kernel. An unprivileged local user could exploit this flaw to cause a denial of service (kernel OOPs), corruption, or potentially escalate privileges on the system. (CVE-2015-5157)

References: https://ubuntu.com/security/notices/USN-2690-1, https://ubuntu.com/security/CVE-2015-1333, https://ubuntu.com/security/CVE-2015-3290, https://ubuntu.com/security/CVE-2015-3291, https://ubuntu.com/security/CVE-2015-5157