USN-2333-1: Linux kernel (EC2) vulnerabilities
First published: Tue Sep 02 2014(Updated: )
A bug was discovered in the handling of pathname components when used with an autofs direct mount. A local user could exploit this flaw to cause a denial of service (system crash) via an open system call. (CVE-2014-0203) Toralf Förster reported an error in the Linux kernels syscall auditing on 32 bit x86 platforms. A local user could exploit this flaw to cause a denial of service (OOPS and system crash). (CVE-2014-4508) An information leak was discovered in the control implemenation of the Advanced Linux Sound Architecture (ALSA) subsystem in the Linux kernel. A local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2014-4652) A use-after-free flaw was discovered in the Advanced Linux Sound Architecture (ALSA) control implementation of the Linux kernel. A local user could exploit this flaw to cause a denial of service (system crash). (CVE-2014-4653) A authorization bug was discovered with the snd_ctl_elem_add function of the Advanced Linux Sound Architecture (ALSA) in the Linux kernel. A local user could exploit his bug to cause a denial of service (remove kernel controls). (CVE-2014-4654) A flaw discovered in how the snd_ctl_elem function of the Advanced Linux Sound Architecture (ALSA) handled a reference count. A local user could exploit this flaw to cause a denial of service (integer overflow and limit bypass). (CVE-2014-4655) An integer overflow flaw was discovered in the control implementation of the Advanced Linux Sound Architecture (ALSA). A local user could exploit this flaw to cause a denial of service (system crash). (CVE-2014-4656) An integer underflow flaw was discovered in the Linux kernel's handling of the backlog value for certain SCTP packets. A remote attacker could exploit this flaw to cause a denial of service (socket outage) via a crafted SCTP packet. (CVE-2014-4667) Jason Gunthorpe reported a flaw with SCTP authentication in the Linux kernel. A remote attacker could exploit this flaw to cause a denial of service (NULL pointer dereference and OOPS). (CVE-2014-5077)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/linux-image-2.6.32-369-ec2 | <2.6.32-369.85 | 2.6.32-369.85 |
| Ubuntu gir1.2-packagekitglib-1.0 | =10.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2014-0203
- https://ubuntu.com/security/CVE-2014-4508
- https://ubuntu.com/security/CVE-2014-4652
- https://ubuntu.com/security/CVE-2014-4653
- https://ubuntu.com/security/CVE-2014-4654
- https://ubuntu.com/security/CVE-2014-4655
- https://ubuntu.com/security/CVE-2014-4656
- https://ubuntu.com/security/CVE-2014-4667
- https://ubuntu.com/security/CVE-2014-5077
- https://ubuntu.com/security/notices/USN-2332-1
- https://ubuntu.com/security/notices/USN-2334-1
- https://ubuntu.com/security/notices/USN-2336-1
- https://ubuntu.com/security/notices/USN-2337-1
- https://ubuntu.com/security/notices/USN-2335-1
- https://ubuntu.com/security/notices/USN-2358-1
- https://ubuntu.com/security/notices/USN-2359-1
- https://launchpad.net/ubuntu/+source/linux-ec2/2.6.32-369.85
- https://ubuntu.com/security/notices/USN-2333-1 (Advisory)
Child vulnerabilities
(Contains the following vulnerabilities)
Frequently Asked Questions
What is the severity of USN-2333-1?
The severity of USN-2333-1 is classified as high due to the potential for denial of service.
How do I fix USN-2333-1?
To fix USN-2333-1, ensure that your system is updated to the latest kernel version provided in the Ubuntu repository.
Which versions of Ubuntu are affected by USN-2333-1?
USN-2333-1 affects Ubuntu 10.04, specifically the linux-image-2.6.32-369-ec2 package up to version 2.6.32-369.85.
What kind of exploit does USN-2333-1 introduce?
USN-2333-1 introduces a vulnerability that allows a local user to perform a denial of service attack, potentially causing a system crash.
Who reported the USN-2333-1 vulnerability?
The vulnerability in USN-2333-1 was reported by Toralf Förster.
- agent/references
- agent/severity
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/title
- agent/weakness
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu gir1.2-packagekitglib-1.0
- version/ubuntu gir1.2-packagekitglib-1.0/10.04