Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 433
Alerts This Week
Warning Icon 1 433

Ubuntu 18.04 LTS: 0053-1 Critical: Kernel Denial of Service Issues

ubuntu
Calendar Grey July 29, 2019
Dist Ubuntu Esm H88
Keep your Ubuntu installations up to date to mitigate critical Linux kernel vulnerabilities, protecting against potential exploits and ensuring system security
Several security issues were fixed in the kernel.

Summary

Several security issues were fixed in the kernel.

Software Description:

- linux: Linux kernel

Details:

Vasiliy Kulikov discovered that the Bluetooth stack did not correctly check

that device name strings were NULL terminated. A local attacker could

exploit this to crash the system, leading to a denial of service, or leak

contents of kernel stack memory, leading to a loss of privacy.

(CVE-2011-1079)

It was discovered that the Linux kernel on ARM processors allowed a tracing

process to modify a syscall after a seccomp decision had been made on that

syscall. A local attacker could possibly use this to bypass seccomp

restrictions. (CVE-2019-2054)

It was discovered that a race condition leading to a use-after-free existed

in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux

kernel. The RDS protocol is blacklisted by default in Ubuntu. If enabled, a

local attacker could use this to cause a denial of service (system crash)

or possibly execute arbitrary code. (...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service ubuntu linux kernel memory exposure

Update Instructions

The problem can be corrected by updating your livepatches to the following
versions:

| Kernel                   | Version  | flavors                  |
|--------------------------+----------+--------------------------|
| 4.4.0-148.174            | 53.1     | lowlatency, generic      |
| 4.4.0-150.176            | 53.1     | generic, lowlatency      |
| 4.4.0-151.178            | 53.1     | lowlatency, generic      |
| 4.4.0-154.181            | 53.1     | lowlatency, generic      |
| 4.15.0-50.54             | 53.1     | generic, lowlatency      |
| 4.15.0-50.54~16.04.1     | 53.1     | generic, lowlatency      |
| 4.15.0-51.55             | 53.1     | generic, lowlatency      |
| 4.15.0-51.55~16.04.1     | 53.1     | generic, lowlatency      |
| 4.15.0-52.56             | 53.1     | lowlatency, generic      |
| 4.15.0-52.56~16.04.1     | 53.1     | generic, lowlatency      |
| 4.15.0-54.58             | 53.1     | generic, lowlatency      |
| 4.15.0-54.58~16.04.1     | 53.1     | generic, lowlatency      |

References

CVE-2011-1079, CVE-2019-2054, CVE-2019-11815, CVE-2019-11833,

CVE-2019-11884

--

ubuntu-security-announce mailing list

ubuntu-security-announce@lists.ubuntu.com

Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

Severity
critical
Lowest
Low
Medium
High
Critical

July 23, 2019

Topics%20covered

Topics Covered

security advisory denial of service ubuntu linux kernel memory exposure

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.