Debian Security Advisory
DSA-4196-1 linux -- security update
- Date Reported:
- 08 May 2018
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 897427, Bug 897599, Bug 898067, Bug 898100.
In Mitre's CVE dictionary: CVE-2018-1087, CVE-2018-8897.
- More information:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation or denial of service.
Andy Lutomirski discovered that the KVM implementation did not properly handle #DB exceptions while deferred by MOV SS/POP SS, allowing an unprivileged KVM guest user to crash the guest or potentially escalate their privileges.
Nick Peterson of Everdox Tech LLC discovered that #DB exceptions that are deferred by MOV SS or POP SS are not properly handled, allowing an unprivileged user to crash the kernel and cause a denial of service.
For the oldstable distribution (jessie), these problems have been fixed in version 3.16.56-1+deb8u1. This update includes various fixes for regressions from 3.16.56-1 as released in DSA-4187-1 (Cf. #897427, #898067 and #898100).
For the stable distribution (stretch), these problems have been fixed in version 4.9.88-1+deb9u1. The fix for CVE-2018-1108 applied in DSA-4188-1 is temporarily reverted due to various regression, cf. #897599.
We recommend that you upgrade your linux packages.
For the detailed security status of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux