The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel prior to 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
linux linux kernel |
This is kind of a big deal because the mess is in 14.04 LTS, expiry date 2019
Ubuntu has patched four Linux kernel vulnerabilities that allowed for arbitrary code execution and denial of service attacjs. The flaws (CVE-2015-8812, CVE-2016-2085, CVE-2016-2550, CVE-2016-2847) is fixed in Ubuntu 14.04 LTS. Researcher Venkatesh Pottem found a use-after-free vulnerability in the Linux kernel CXGB3 driver which local hackers could use to trigger a crash or execute arbitrary code. Xiaofei Rex Guo reported a second timing side channel vulnerability in the Linux Extended Verificat...
Vulmon