Debian Security Advisory

DSA-4196-1 linux -- security update

Date Reported:
08 May 2018
Affected Packages:
linux
Vulnerable:
Yes
Security database references:
In the Debian bugtracking system: Bug 897427, Bug 897599, Bug 898067, Bug 898100.
In Mitre's CVE dictionary: CVE-2018-1087, CVE-2018-8897.
More information:

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation or denial of service.

  • CVE-2018-1087

    Andy Lutomirski discovered that the KVM implementation did not properly handle #DB exceptions while deferred by MOV SS/POP SS, allowing an unprivileged KVM guest user to crash the guest or potentially escalate their privileges.

  • CVE-2018-8897

    Nick Peterson of Everdox Tech LLC discovered that #DB exceptions that are deferred by MOV SS or POP SS are not properly handled, allowing an unprivileged user to crash the kernel and cause a denial of service.

For the oldstable distribution (jessie), these problems have been fixed in version 3.16.56-1+deb8u1. This update includes various fixes for regressions from 3.16.56-1 as released in DSA-4187-1 (Cf. #897427, #898067 and #898100).

For the stable distribution (stretch), these problems have been fixed in version 4.9.88-1+deb9u1. The fix for CVE-2018-1108 applied in DSA-4188-1 is temporarily reverted due to various regression, cf. #897599.

We recommend that you upgrade your linux packages.

For the detailed security status of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux