It was reported that due to buffer overflow, it is possible for remote TCP endpoint to trigger the opposite TCP endpoint to write to a socket in sequence which causes the ethernet driver to send arbitrary kernel data over the ethernet interface instead of a portion of the intended packet data.

Initially this issue was believed to be present in a number of mainline drivers in 3.10.x and 4.4.2 vanilla kernel sources. After further investigation it was found that only [atl2] driver (code in drivers/net/ethernet/atheros/atlx/atl2.c) from the list of suspected drivers is vulnerable.

As a result, certain conditions should be met to trigger the issue: - the [atl2] driver and the corresponding network card (which believed to be not so frequently used) should be present on the target system - an application should make such a sequence of calls that a network buffer for the data to be transmitted is scattered - hardware checksumming should be enabled so the packet checksum is correct

The above makes this vulnerability less probable to be hit.

A local user can trigger a flaw in the Linux kernel's handling of key lookups in the keychain subsystem.

The keyrejectandlink() function contains an error in which a key-lookup can fail and in an attempt to cache the failed lookup may attempt to free memory which can still be in use.

This could crash the system or at worse free a memory block which would then be re-used by another kernel mechanism causing a user after free.

Product bug:

https://bugzilla.redhat.com/showbug.cgi?id=1341352

Upstream patch:

https://www.spinics.net/lists/linux-kernel-janitors/msg26069.html

A flaw was found in the implementation of the Linux kernels handling of networking challenge ack where an attacker is able to determine the shared counter.

This may allow an attacker located on different subnet to inject or take over a TCP connection between a server and client without having to be a traditional Man In the Middle (MITM) style attack.

OSS-Security post: http://seclists.org/oss-sec/2016/q3/44

Upstream patch: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=75ff39ccc1bd5d3c455b6822ab09e533c551f758

Heap-based buffer overflow in the PackBitsPreEncode function in tifpackbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image.

The libxl device-handling in Xen 4.6.x and earlier allows local OS guest administrators to cause a denial of service (resource consumption or management facility confusion) or gain host OS privileges by manipulating information in guest controlled areas of xenstore.

A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a heap-based buffer underread in xmlParseName.

References:

https://bugzilla.gnome.org/showbug.cgi?id=759573

Upstream fix:

https://git.gnome.org/browse/libxml2/commit/?id=00906759053986b8079985644172085f74331f83

The guestwalktables function in arch/x86/mm/guestwalk.c in Xen 4.6.x and earlier does not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might allow local guest OS users to gain privileges via a crafted mapping of memory.

A vulnerability was found in the libxml2 library. There exist a possible format string vulnerability.

https://bugzilla.gnome.org/showbug.cgi?id=761029

Upstream fixes:

https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9 https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b

An Out-of-bounds write vulnerability caused by heap overflow when using tiffcrop tool was found in the libtiff library. The vulnerability is in loadImage() function in tiffcrop.c. loadImage() will read the numbers of tiles by calling TIFFNumberOfTiles().

However, if the numbers of tiles is 0, loadImage() will still read tile data by calling readContigTilesIntoBuffer() from the image, regardless of the numbers. In that case, loadImage() will allocate 3 bytes in the heap to store a tile data.

This creates a potential attack vector via crafted tiff tiles, which may result in DoS or code execution.

Upstream bug report: http://bugzilla.maptools.org/showbug.cgi?id=2543

An out-of-bounds write flaw was found in libtiff v4.0.6 when using tiffcp command to handle malicious tiff file. The vulnerability exists in function horizontalDifference8() An attacker could control the head data of next heap which contains presize field and size filed to result in DoS or potential code execution.

Vulnerable code:

Source info

============ 1082 wp += n + stride - 1; / point to last one / 1083 ip += n + stride - 1; / point to last one / 1084 n -= stride; 1085 while (n > 0) { 1086 REPEAT(stride, wp[0] = CLAMP(ip[0]); 1087 wp[stride] -= wp[0]; 1088 wp[stride] &= mask; 1089 wp--; ip--) 1090 n -= stride; 1091 } 1092 REPEAT(stride, wp[0] = CLAMP(ip[0]); wp--; ip--)

References:

http://seclists.org/oss-sec/2016/q2/57

Upstream bug:

http://bugzilla.maptools.org/showbug.cgi?id=2544

Integer overflow in the x86 shadow pagetable code in Xen allows local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping.

Multiple integer overflows in the (1) cvtbystrip and (2) cvtbytile functions in the tiff2rgba tool in LibTIFF 4.0.6 and earlier, when -b mode is enabled, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image, which triggers an out-of-bounds write.

Qemu emulator built with VGA emulation with VESA BIOS Extensions(VBE) support is vulnerable to an OOB r/w access issue. It could occur while doing VGA r/w operations via i/o port methods.

A privileged guest user could use this flaw to potentially execute arbitrary code, with privileges of the Qemu process on the host.

Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg01197.html

Reference: ---------- -> http://www.openwall.com/lists/oss-security/2016/05/09/3

Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode.

Out-of-bounds write vulnerability was found in TIFFVGetField function in tifdirinfo.c, allowing attacker to cause a denial of service or command execution via a crafted TIFF image.

Vulnerable code:

libtiff/tifdir.c:1073 1068 if (fip->fieldtype == TIFFASCII 1069 || fip->fieldreadcount == TIFFVARIABLE 1070 || fip->fieldreadcount == TIFFVARIABLE2 1071 || fip->fieldreadcount == TIFFSPP 1072 || tv->count > 1) { 1073 vaarg(ap, void ) = tv->value; 1074 retval = 1;

Public via:

http://seclists.org/oss-sec/2016/q2/33

Upstream bug: http://bugzilla.maptools.org/showbug.cgi?id=2549

The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076.

The fpufxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076.

buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.