USN-2016-1: Linux kernel (EC2) vulnerabilities
Dan Carpenter discovered an information leak in the HP Smart Array and Compaq SMART2 disk-array driver in the Linux kernel. A local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-2147) Kees Cook discovered flaw in the Human Interface Device (HID) subsystem when CONFIGHIDZEROPLUS is enabled. A physically proximate attacker could leverage this flaw to cause a denial of service via a specially crafted device. (CVE-2013-2889) Kees Cook discovered another flaw in the Human Interface Device (HID) subsystem of the Linux kernel when any of CONFIGLOGITECHFF, CONFIGLOGIG940FF, or CONFIGLOGIWHEELSFF are enabled. A physcially proximate attacker can leverage this flaw to cause a denial of service vias a specially crafted device. (CVE-2013-2893) Kees Cook discovered yet another flaw in the Human Interface Device (HID) subsystem of the Linux kernel when CONFIGHIDMULTITOUCH is enabled. A physically proximate attacker could leverage this flaw to cause a denial of service (OOPS) via a specially crafted device. (CVE-2013-2897) A flaw was discovered in the Linux kernel's dm snapshot facility. A remote authenticated user could exploit this flaw to obtain sensitive information or modify/corrupt data. (CVE-2013-4299)
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-2016-1?
The severity of USN-2016-1 is categorized as medium due to the potential for local users to exploit the information leak.
How do I fix USN-2016-1?
To fix USN-2016-1, you should upgrade to the linux-image-2.6.32-358-ec2 package version 2.6.32-358.71 or later.
Who discovered the vulnerability in USN-2016-1?
Dan Carpenter and Kees Cook discovered the vulnerabilities addressed in USN-2016-1.
What systems are affected by USN-2016-1?
USN-2016-1 affects Ubuntu 10.04 systems running the linux-image-2.6.32-358-ec2 package.
Can a remote user exploit the vulnerability in USN-2016-1?
No, USN-2016-1 vulnerability requires local access for exploitation.