USN-2979-1

Dashboard / Vulnerabilities / USN-2979-1

USN-2979-1

Summary: linux vulnerabilities

Details: David Matlack discovered that the Kernel-based Virtual Machine (KVM) implementation in the Linux kernel did not properly restrict variable Memory Type Range Registers (MTRR) in KVM guests. A privileged user in a guest VM could use this to cause a denial of service (system crash) in the host, expose sensitive information from the host, or possibly gain administrative privileges in the host. (CVE-2016-3713) Philip Pettersson discovered that the Linux kernel's ASN.1 DER decoder did not properly process certificate files with tags of indefinite length. A local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges. (CVE-2016-0758)

References: https://ubuntu.com/security/notices/USN-2979-1, https://ubuntu.com/security/CVE-2016-0758, https://ubuntu.com/security/CVE-2016-3713