[LSN-0058-1] Linux kernel vulnerability
benjamin.romer at canonical.com
benjamin.romer at canonical.com
Tue Oct 22 12:16:38 UTC 2019
==========================================================================
Kernel Live Patch Security Notice 0058-1
October 22, 2019
linux vulnerability
==========================================================================
A security issue affects these releases of Ubuntu:
| Series | Base kernel | Arch | flavors |
|------------------+--------------+----------+------------------|
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | aws |
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | generic |
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | lowlatency |
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | oem |
| Ubuntu 18.04 LTS | 5.0.0 | amd64 | azure |
| Ubuntu 14.04 LTS | 4.4.0 | amd64 | generic |
| Ubuntu 14.04 LTS | 4.4.0 | amd64 | lowlatency |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | aws |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | generic |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | lowlatency |
| Ubuntu 16.04 LTS | 4.15.0 | amd64 | azure |
| Ubuntu 16.04 LTS | 4.15.0 | amd64 | generic |
| Ubuntu 16.04 LTS | 4.15.0 | amd64 | lowlatency |
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux: Linux kernel
Details:
It was discovered that a race condition existed in the GFS2 file system in
the Linux kernel. A local attacker could possibly use this to cause a
denial of service (system crash). (CVE-2016-10905)
It was discovered that a use-after-free error existed in the block layer
subsystem of the Linux kernel when certain failure conditions occurred. A
local attacker could possibly use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2018-20856)
It was discovered that the USB gadget Midi driver in the Linux kernel
contained a double-free vulnerability when handling certain error
conditions. A local attacker could use this to cause a denial of service
(system crash). (CVE-2018-20961)
It was discovered that the XFS file system in the Linux kernel did not
properly handle mount failures in some situations. A local attacker could
possibly use this to cause a denial of service (system crash) or execute
arbitrary code. (CVE-2018-20976)
It was discovered that the RSI 91x Wi-Fi driver in the Linux kernel did not
did not handle detach operations correctly, leading to a use-after-free
vulnerability. A physically proximate attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2018-21008)
It was discovered that the Intel Wi-Fi device driver in the Linux kernel
did not properly validate certain Tunneled Direct Link Setup (TDLS). A
physically proximate attacker could use this to cause a denial of service
(Wi-Fi disconnect). (CVE-2019-0136)
It was discovered that the Linux kernel on ARM processors allowed a tracing
process to modify a syscall after a seccomp decision had been made on that
syscall. A local attacker could possibly use this to bypass seccomp
restrictions. (CVE-2019-2054)
It was discovered that an integer overflow existed in the Binder
implementation of the Linux kernel, leading to a buffer overflow. A local
attacker could use this to escalate privileges. (CVE-2019-2181)
It was discovered that the Marvell Wireless LAN device driver in the Linux
kernel did not properly validate the BSS descriptor. A local attacker could
possibly use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2019-3846)
It was discovered that a heap buffer overflow existed in the Marvell
Wireless LAN device driver for the Linux kernel. An attacker could use this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2019-10126)
It was discovered that the Bluetooth UART implementation in the Linux
kernel did not properly check for missing tty operations. A local attacker
could use this to cause a denial of service. (CVE-2019-10207)
Jonathan Looney discovered that an integer overflow existed in the Linux
kernel when handling TCP Selective Acknowledgments (SACKs). A remote
attacker could use this to cause a denial of service (system crash).
(CVE-2019-11477)
Jonathan Looney discovered that the TCP retransmission queue implementation
in the Linux kernel could be fragmented when handling certain TCP Selective
Acknowledgment (SACK) sequences. A remote attacker could use this to cause
a denial of service. (CVE-2019-11478)
It was discovered that the ext4 file system implementation in the Linux
kernel did not properly zero out memory in some situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2019-11833)
It was discovered that the PowerPC dlpar implementation in the Linux kernel
did not properly check for allocation errors in some situations. A local
attacker could possibly use this to cause a denial of service (system
crash). (CVE-2019-12614)
It was discovered that the floppy driver in the Linux kernel did not
properly validate meta data, leading to a buffer overread. A local attacker
could use this to cause a denial of service (system crash).
(CVE-2019-14283)
It was discovered that the floppy driver in the Linux kernel did not
properly validate ioctl() calls, leading to a division-by-zero. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2019-14284)
Wen Huang discovered that the Marvell Wi-Fi device driver in the Linux
kernel did not properly perform bounds checking, leading to a heap
overflow. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2019-14814)
Wen Huang discovered that the Marvell Wi-Fi device driver in the Linux
kernel did not properly perform bounds checking, leading to a heap
overflow. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2019-14815)
Wen Huang discovered that the Marvell Wi-Fi device driver in the Linux
kernel did not properly perform bounds checking, leading to a heap
overflow. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2019-14816)
Matt Delco discovered that the KVM hypervisor implementation in the Linux
kernel did not properly perform bounds checking when handling coalesced
MMIO write operations. A local attacker with write access to /dev/kvm could
use this to cause a denial of service (system crash). (CVE-2019-14821)
Peter Pi discovered a buffer overflow in the virtio network backend
(vhost_net) implementation in the Linux kernel. An attacker in a guest may
be able to use this to cause a denial of service (host OS crash) or
possibly execute arbitrary code in the host OS. (CVE-2019-14835)
Update instructions:
The problem can be corrected by updating your livepatches to the following
versions:
| Kernel | Version | flavors |
|--------------------------+----------+--------------------------|
| 4.4.0-148.174 | 58.1 | lowlatency, generic |
| 4.4.0-148.174~14.04.1 | 58.1 | lowlatency, generic |
| 4.4.0-150.176 | 58.1 | generic, lowlatency |
| 4.4.0-150.176~14.04.1 | 58.1 | lowlatency, generic |
| 4.4.0-151.178 | 58.1 | lowlatency, generic |
| 4.4.0-151.178~14.04.1 | 58.1 | generic, lowlatency |
| 4.4.0-154.181 | 58.1 | lowlatency, generic |
| 4.4.0-154.181~14.04.1 | 58.1 | generic, lowlatency |
| 4.4.0-157.185 | 58.1 | lowlatency, generic |
| 4.4.0-157.185~14.04.1 | 58.1 | generic, lowlatency |
| 4.4.0-159.187 | 58.1 | lowlatency, generic |
| 4.4.0-159.187~14.04.1 | 58.1 | generic, lowlatency |
| 4.4.0-161.189 | 58.1 | lowlatency, generic |
| 4.4.0-161.189~14.04.1 | 58.1 | lowlatency, generic |
| 4.4.0-164.192 | 58.1 | lowlatency, generic |
| 4.4.0-164.192~14.04.1 | 58.1 | lowlatency, generic |
| 4.4.0-165.193 | 58.1 | generic, lowlatency |
| 4.4.0-1083.93 | 58.1 | aws |
| 4.4.0-1084.94 | 58.1 | aws |
| 4.4.0-1085.96 | 58.1 | aws |
| 4.4.0-1087.98 | 58.1 | aws |
| 4.4.0-1088.99 | 58.1 | aws |
| 4.4.0-1090.101 | 58.1 | aws |
| 4.4.0-1092.103 | 58.1 | aws |
| 4.4.0-1094.105 | 58.1 | aws |
| 4.15.0-50.54 | 58.1 | generic, lowlatency |
| 4.15.0-50.54~16.04.1 | 58.1 | generic, lowlatency |
| 4.15.0-51.55 | 58.1 | generic, lowlatency |
| 4.15.0-51.55~16.04.1 | 58.1 | generic, lowlatency |
| 4.15.0-52.56 | 58.1 | lowlatency, generic |
| 4.15.0-52.56~16.04.1 | 58.1 | generic, lowlatency |
| 4.15.0-54.58 | 58.1 | generic, lowlatency |
| 4.15.0-54.58~16.04.1 | 58.1 | generic, lowlatency |
| 4.15.0-55.60 | 58.1 | generic, lowlatency |
| 4.15.0-58.64 | 58.1 | generic, lowlatency |
| 4.15.0-58.64~16.04.1 | 58.1 | lowlatency, generic |
| 4.15.0-60.67 | 58.1 | lowlatency, generic |
| 4.15.0-60.67~16.04.1 | 58.1 | generic, lowlatency |
| 4.15.0-62.69 | 58.1 | generic, lowlatency |
| 4.15.0-62.69~16.04.1 | 58.1 | lowlatency, generic |
| 4.15.0-64.73 | 58.1 | generic, lowlatency |
| 4.15.0-64.73~16.04.1 | 58.1 | lowlatency, generic |
| 4.15.0-65.74 | 58.1 | lowlatency, generic |
| 4.15.0-1038.43 | 58.1 | oem |
| 4.15.0-1039.41 | 58.1 | aws |
| 4.15.0-1039.44 | 58.1 | oem |
| 4.15.0-1040.42 | 58.1 | aws |
| 4.15.0-1041.43 | 58.1 | aws |
| 4.15.0-1043.45 | 58.1 | aws |
| 4.15.0-1043.48 | 58.1 | oem |
| 4.15.0-1044.46 | 58.1 | aws |
| 4.15.0-1045.47 | 58.1 | aws |
| 4.15.0-1045.50 | 58.1 | oem |
| 4.15.0-1047.49 | 58.1 | aws |
| 4.15.0-1047.51 | 58.1 | azure |
| 4.15.0-1048.50 | 58.1 | aws |
| 4.15.0-1049.54 | 58.1 | azure |
| 4.15.0-1050.52 | 58.1 | aws |
| 4.15.0-1050.55 | 58.1 | azure |
| 4.15.0-1050.57 | 58.1 | oem |
| 4.15.0-1051.53 | 58.1 | aws |
| 4.15.0-1051.56 | 58.1 | azure |
| 4.15.0-1052.57 | 58.1 | azure |
| 4.15.0-1055.60 | 58.1 | azure |
| 4.15.0-1056.61 | 58.1 | azure |
| 4.15.0-1056.65 | 58.1 | oem |
| 4.15.0-1057.62 | 58.1 | azure |
| 4.15.0-1057.66 | 58.1 | oem |
| 4.15.0-1059.64 | 58.1 | azure |
| 5.0.0-1014.14~18.04.1 | 58.1 | azure |
| 5.0.0-1016.17~18.04.1 | 58.1 | azure |
| 5.0.0-1018.19~18.04.1 | 58.1 | azure |
| 5.0.0-1020.21~18.04.1 | 58.1 | azure |
Support Information:
Kernels older than the levels listed below do not receive livepatch
updates. Please upgrade your kernel as soon as possible.
| Series | Version | Flavors |
|------------------+------------------+--------------------------|
| Ubuntu 18.04 LTS | 4.15.0-1039 | aws |
| Ubuntu 16.04 LTS | 4.4.0-1083 | aws |
| Ubuntu 18.04 LTS | 5.0.0-1000 | azure |
| Ubuntu 16.04 LTS | 4.15.0-1047 | azure |
| Ubuntu 18.04 LTS | 4.15.0-50 | generic lowlatency |
| Ubuntu 16.04 LTS | 4.15.0-50 | generic lowlatency |
| Ubuntu 14.04 LTS | 4.4.0-148 | generic lowlatency |
| Ubuntu 18.04 LTS | 4.15.0-1038 | oem |
| Ubuntu 16.04 LTS | 4.4.0-148 | generic lowlatency |
References:
CVE-2016-10905, CVE-2018-20856, CVE-2018-20961, CVE-2018-20976,
CVE-2018-21008, CVE-2019-0136, CVE-2019-2054, CVE-2019-2181,
CVE-2019-3846, CVE-2019-10126, CVE-2019-10207, CVE-2019-11477,
CVE-2019-11478, CVE-2019-11833, CVE-2019-12614, CVE-2019-14283,
CVE-2019-14284, CVE-2019-14814, CVE-2019-14815, CVE-2019-14816,
CVE-2019-14821, CVE-2019-14835
More information about the ubuntu-security-announce
mailing list