[LSN-0053-1] Linux kernel vulnerability

[benjamin.romer at canonical.com]

==========================================================================
Kernel Live Patch Security Notice 0053-1
July 23, 2019

linux vulnerability
==========================================================================

A security issue affects these releases of Ubuntu:

| Series           | Base kernel  | Arch     | flavors          |
|------------------+--------------+----------+------------------|
| Ubuntu 18.04 LTS | 4.15.0       | amd64    | generic          |
| Ubuntu 18.04 LTS | 4.15.0       | amd64    | lowlatency       |
| Ubuntu 16.04 LTS | 4.4.0        | amd64    | generic          |
| Ubuntu 16.04 LTS | 4.4.0        | amd64    | lowlatency       |

Summary:

Several security issues were fixed in the kernel.

Software Description:
- linux: Linux kernel

Details:

Vasiliy Kulikov discovered that the Bluetooth stack did not correctly check
that device name strings were NULL terminated. A local attacker could
exploit this to crash the system, leading to a denial of service, or leak
contents of kernel stack memory, leading to a loss of privacy. 
(CVE-2011-1079)

It was discovered that the Linux kernel on ARM processors allowed a tracing
process to modify a syscall after a seccomp decision had been made on that
syscall. A local attacker could possibly use this to bypass seccomp
restrictions. (CVE-2019-2054)

It was discovered that a race condition leading to a use-after-free existed
in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux
kernel. The RDS protocol is blacklisted by default in Ubuntu. If enabled, a
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2019-11815)

It was discovered that the ext4 file system implementation in the Linux
kernel did not properly zero out memory in some situations. A local
attacker could use this to expose sensitive information (kernel memory). 
(CVE-2019-11833)

It was discovered that the Bluetooth Human Interface Device Protocol (HIDP)
implementation in the Linux kernel did not properly verify strings were
NULL terminated in certain situations. A local attacker could use this to
expose sensitive information (kernel memory). (CVE-2019-11884)

Update instructions:

The problem can be corrected by updating your livepatches to the following
versions:

| Kernel                   | Version  | flavors                  |
|--------------------------+----------+--------------------------|
| 4.4.0-148.174            | 53.1     | lowlatency, generic      |
| 4.4.0-150.176            | 53.1     | generic, lowlatency      |
| 4.4.0-151.178            | 53.1     | lowlatency, generic      |
| 4.4.0-154.181            | 53.1     | lowlatency, generic      |
| 4.15.0-50.54             | 53.1     | generic, lowlatency      |
| 4.15.0-50.54~16.04.1     | 53.1     | generic, lowlatency      |
| 4.15.0-51.55             | 53.1     | generic, lowlatency      |
| 4.15.0-51.55~16.04.1     | 53.1     | generic, lowlatency      |
| 4.15.0-52.56             | 53.1     | lowlatency, generic      |
| 4.15.0-52.56~16.04.1     | 53.1     | generic, lowlatency      |
| 4.15.0-54.58             | 53.1     | generic, lowlatency      |
| 4.15.0-54.58~16.04.1     | 53.1     | generic, lowlatency      |

References:
  CVE-2011-1079, CVE-2019-2054, CVE-2019-11815, CVE-2019-11833, 
  CVE-2019-11884