Multiple vulnerabilities has been found and corrected in the Linux
kernel:
The SCTP implementation in the Linux kernel before 3.17.4 allows
remote attackers to cause a denial of service (memory consumption) by
triggering a large number of chunks in an association’s output queue,
as demonstrated by ASCONF probes, related to net/sctp/inqueue.c and
net/sctp/sm_statefuns.c (CVE-2014-3688=.
Buffer overflow in net/ceph/auth_x.c in Ceph, as used in the Linux
kernel before 3.16.3, allows remote attackers to cause a denial of
service (memory corruption and panic) or possibly have unspecified
other impact via a long unencrypted auth ticket (CVE-2014-6416).
net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3,
does not properly consider the possibility of kmalloc failure, which
allows remote attackers to cause a denial of service (system crash)
or possibly have unspecified other impact via a long unencrypted auth
ticket (CVE-2014-6417).
net/ceph/auth_x.c in Ceph, as used in the Linux kernel before
3.16.3, does not properly validate auth replies, which allows remote
attackers to cause a denial of service (system crash) or possibly
have unspecified other impact via crafted data from the IP address
of a Ceph Monitor (CVE-2014-6418).
The sctp_process_param function in net/sctp/sm_make_chunk.c in the
SCTP implementation in the Linux kernel before 3.17.4, when ASCONF
is used, allows remote attackers to cause a denial of service (NULL
pointer dereference and system crash) via a malformed INIT chunk
(CVE-2014-7841).
Race condition in arch/x86/kvm/x86.c in the Linux kernel before 3.17.4
allows guest OS users to cause a denial of service (guest OS crash)
via a crafted application that performs an MMIO transaction or a
PIO transaction to trigger a guest userspace emulation error report,
a similar issue to CVE-2010-5313 (CVE-2014-7842).
arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation
in the Linux kernel through 3.18.1 allows local users to bypass the
espfix protection mechanism, and consequently makes it easier for
local users to bypass the ASLR protection mechanism, via a crafted
application that makes a set_thread_area system call and later reads
a 16-bit value (CVE-2014-8133).
Stack-based buffer overflow in the
ttusbdecfe_dvbs_diseqc_send_master_cmd function in
drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel before
3.17.4 allows local users to cause a denial of service (system crash)
or possibly gain privileges via a large message length in an ioctl call
(CVE-2014-8884).
The do_double_fault function in arch/x86/kernel/traps.c in the Linux
kernel through 3.17.4 does not properly handle faults associated with
the Stack Segment (SS) segment register, which allows local users
to cause a denial of service (panic) via a modify_ldt system call,
as demonstrated by sigreturn_32 in the linux-clock-tests test suite
(CVE-2014-9090).
arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does
not properly handle faults associated with the Stack Segment (SS)
segment register, which allows local users to gain privileges by
triggering an IRET instruction that leads to access to a GS Base
address from the wrong space (CVE-2014-9322).
The __switch_to function in arch/x86/kernel/process_64.c in the Linux
kernel through 3.18.1 does not ensure that Thread Local Storage (TLS)
descriptors are loaded before proceeding with other steps, which makes
it easier for local users to bypass the ASLR protection mechanism via
a crafted application that reads a TLS base address (CVE-2014-9419).
The rock_continue function in fs/isofs/rock.c in the Linux kernel
through 3.18.1 does not restrict the number of Rock Ridge continuation
entries, which allows local users to cause a denial of service
(infinite loop, and system crash or hang) via a crafted iso9660 image
(CVE-2014-9420).
Race condition in the key_gc_unused_keys function in security/keys/gc.c
in the Linux kernel through 3.18.2 allows local users to cause a denial
of service (memory corruption or panic) or possibly have unspecified
other impact via keyctl commands that trigger access to a key structure
member during garbage collection of a key (CVE-2014-9529).
The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in
the Linux kernel before 3.18.2 does not validate a length value in
the Extensions Reference (ER) System Use Field, which allows local
users to obtain sensitive information from kernel memory via a crafted
iso9660 image (CVE-2014-9584).
The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel
through 3.18.2 does not properly choose memory locations for the
vDSO area, which makes it easier for local users to bypass the ASLR
protection mechanism by guessing a location at the end of a PMD
(CVE-2014-9585).
The updated packages provides a solution for these security issues.