Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 544
Alerts This Week
Warning Icon 1 544

Ubuntu 16.04 LTS: 0037-1 Critical Denial of Service Flaws in Kernel

ubuntu
Calendar Grey May 2, 2018
Scroller Ubuntu
Kernel Live Patch Security Bulletin LSN-0042-3 resolves various vulnerabilities, mitigating possible threats from internal exploits.
Several security issues were fixed in the kernel.

Summary

Several security issues were fixed in the kernel.

Software Description:

- linux: Linux kernel

Details:

Jann Horn discovered that the Berkeley Packet Filter (BPF) implementation

in the Linux kernel improperly performed sign extension in some situations.

A local attacker could use this to cause a denial of service (system crash)

or possibly execute arbitrary code. (CVE-2017-16995)

It was discovered that a race condition leading to a use-after-free

vulnerability existed in the ALSA PCM subsystem of the Linux kernel. A

local attacker could use this to cause a denial of service (system crash)

or possibly execute arbitrary code. (CVE-2017-0861)

It was discovered that a use-after-free vulnerability existed in the

network namespaces implementation in the Linux kernel. A local attacker

could use this to cause a denial of service (system crash) or possibly

execute arbitrary code. (CVE-2017-15129)

It was discovered that the netfilter component of the Linux did not

properly restrict acce...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service critical Ubuntu kernel local attack system crash

Update Instructions

The problem can be corrected by updating your livepatches to the following
versions:

| Kernel          | Version  | flavors                  |
|-----------------+----------+--------------------------|
| 4.4.0-116.140	  | 37.2     | generic, lowlatency      |
| 4.4.0-119.143   | 37.2     | generic, lowlatency      |
| 4.4.0-121.145   | 37.2     | generic, lowlatency      |
| 4.4.0-122.146   | 37.2     | generic, lowlatency      |
| 4.4.0-116.140~14.04.1 | 37.2     | generic, lowlatency      |
| 4.4.0-119.143~14.04.1 | 37.2     | generic, lowlatency      |
| 4.4.0-121.145~14.04.1 | 37.2     | generic, lowlatency      |

Additionally, you should install an updated kernel with these fixes and
reboot at your convienience.

References

CVE-2017-0861, CVE-2017-15129, CVE-2017-16995, CVE-2017-17448,

CVE-2017-17450, CVE-2018-1000199, CVE-2018-5333, CVE-2018-5344,

CVE-2018-8043

--

ubuntu-security-announce mailing list

ubuntu-security-announce@lists.ubuntu.com

Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

Severity
critical
Lowest
Low
Medium
High
Critical

May 02, 2018

Topics%20covered

Topics Covered

security advisory denial of service critical Ubuntu kernel local attack system crash

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.