Softpedia >News >Linux >Linux Distributions
Softpedia Homepage   

Debian Patches Two Security Flaws in Stretch and Jessie with New Kernel Update

The new kernel version also addresses some regressions

May 8, 2018 23:59 GMT  ·  By
New kernel released for Debian GNU/Linux
   New kernel released for Debian GNU/Linux

Debian Project's Salvatore Bonaccorso announced today the availability of a new kernel patch for both Debian GNU/Linux 9 "Stretch" and Debian GNU/Linux 8 "Jessie" operating system series to patch two security vulnerabilities and address some regressions.

One of the security vulnerabilities patched by this new kernel update was discovered by Andy Lutomirski in Linux kernel's KVM (Kernel-based virtual machine) implementation, which could allow an unprivileged KVM guest user to escalate their privileges or crash the guest operating system (CVE-2018-1087).

The second security flaw addressed in this kernel update was discovered by Nick Peterson of Everdox Tech LLC in the way Linux kernel handles exceptions delivered by Mov SS or Pop SS instructions, allowing an unprivileged user to cause a denial of service and crash the kernel (CVE-2018-8897).

Debian Stretch and Jessie users urged to update their kernels

The kernel patch released on Tuesday, May 8, 2018, also patches a total of three regressions discovered since last week's kernel update in the oldstable Debian GNU/Linux 8 "Jessie" distribution and a single regression in the stable Debian GNU/Linux 9 "Stretch" distribution. These are referred to as bugs #897427, #897599, #898067, and #898100.

All these issues can be patched if you update your kernel to version 4.9.88-1+deb9u1 on the Debian GNU/Linux 9 "Stretch" release, as well as to version 3.16.56-1+deb8u1 on the Debian GNU/Linux 8 "Jessie" release. All Debian Stretch and Jessie users urged to update their kernels as soon as possible, and reboot their computer after installing the new kernel versions for the changes to take effect.

Last week, the Debian Project released a major kernel update for both Debian GNU/Linux 9 "Stretch" and Debian GNU/Linux 8 "Jessie" operating system series to patch a total of 27 security vulnerabilities, including a privilege escalation flaw that lurked in the Linux kernel for the past eight years. However, Debian Project temporarily reverted the fix for CVE-2018-1108 due to various regressions.