USN-3377-1: Linux kernel vulnerabilities
Fan Wu and Shixiong Zhao discovered a race condition between inotify events and vfs rename operations in the Linux kernel. An unprivileged local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2017-7533) It was discovered that the Linux kernel did not properly restrict RLIMITSTACK size. A local attacker could use this in conjunction with another vulnerability to possibly execute arbitrary code. (CVE-2017-1000365) 李强 discovered that the Virtio GPU driver in the Linux kernel did not properly free memory in some situations. A local attacker could use this to cause a denial of service (memory consumption). (CVE-2017-10810) 石磊 discovered that the RxRPC Kerberos 5 ticket handling code in the Linux kernel did not properly verify metadata. A remote attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-7482)
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What vulnerability does USN-3377-1 address?
USN-3377-1 addresses a race condition vulnerability in the Linux kernel.
What is the severity of USN-3377-1?
The severity of USN-3377-1 is not specified.
How can an attacker exploit the vulnerability described in USN-3377-1?
An attacker can exploit this vulnerability to cause a denial of service (system crash) or execute arbitrary code.
What software versions are affected by USN-3377-1?
The affected software versions are Linux kernel versions 4.10.0.30.31, 4.10.0-30.34, 4.10.0-1013.16, and 4.10.0.1013.15 on Ubuntu 17.04.
How can I fix the vulnerability described in USN-3377-1?
To fix the vulnerability, update your Linux kernel to version 4.10.0.30.31, 4.10.0-30.34, 4.10.0-1013.16, or 4.10.0.1013.15.