Ubuntu 0058-1: Linux kernel vulnerability

    Date 22 Oct 2019
    160
    Posted By LinuxSecurity Advisories
    Several security issues were fixed in the kernel.
    ==========================================================================
    Kernel Live Patch Security Notice 0058-1
    October 22, 2019
    
    linux vulnerability
    ==========================================================================
    
    A security issue affects these releases of Ubuntu:
    
    | Series           | Base kernel  | Arch     | flavors          |
    |------------------+--------------+----------+------------------|
    | Ubuntu 18.04 LTS | 4.15.0       | amd64    | aws              |
    | Ubuntu 18.04 LTS | 4.15.0       | amd64    | generic          |
    | Ubuntu 18.04 LTS | 4.15.0       | amd64    | lowlatency       |
    | Ubuntu 18.04 LTS | 4.15.0       | amd64    | oem              |
    | Ubuntu 18.04 LTS | 5.0.0        | amd64    | azure            |
    | Ubuntu 14.04 LTS | 4.4.0        | amd64    | generic          |
    | Ubuntu 14.04 LTS | 4.4.0        | amd64    | lowlatency       |
    | Ubuntu 16.04 LTS | 4.4.0        | amd64    | aws              |
    | Ubuntu 16.04 LTS | 4.4.0        | amd64    | generic          |
    | Ubuntu 16.04 LTS | 4.4.0        | amd64    | lowlatency       |
    | Ubuntu 16.04 LTS | 4.15.0       | amd64    | azure            |
    | Ubuntu 16.04 LTS | 4.15.0       | amd64    | generic          |
    | Ubuntu 16.04 LTS | 4.15.0       | amd64    | lowlatency       |
    
    Summary:
    
    Several security issues were fixed in the kernel.
    
    Software Description:
    - linux: Linux kernel
    
    Details:
    
    It was discovered that a race condition existed in the GFS2 file system in
    the Linux kernel. A local attacker could possibly use this to cause a
    denial of service (system crash). (CVE-2016-10905)
    
    It was discovered that a use-after-free error existed in the block layer
    subsystem of the Linux kernel when certain failure conditions occurred. A
    local attacker could possibly use this to cause a denial of service (system
    crash) or possibly execute arbitrary code. (CVE-2018-20856)
    
    It was discovered that the USB gadget Midi driver in the Linux kernel
    contained a double-free vulnerability when handling certain error
    conditions. A local attacker could use this to cause a denial of service
    (system crash). (CVE-2018-20961)
    
    It was discovered that the XFS file system in the Linux kernel did not
    properly handle mount failures in some situations. A local attacker could
    possibly use this to cause a denial of service (system crash) or execute
    arbitrary code. (CVE-2018-20976)
    
    It was discovered that the RSI 91x Wi-Fi driver in the Linux kernel did not
    did not handle detach operations correctly, leading to a use-after-free
    vulnerability. A physically proximate attacker could use this to cause a
    denial of service (system crash) or possibly execute arbitrary code. 
    (CVE-2018-21008)
    
    It was discovered that the Intel Wi-Fi device driver in the Linux kernel
    did not properly validate certain Tunneled Direct Link Setup (TDLS). A
    physically proximate attacker could use this to cause a denial of service
    (Wi-Fi disconnect). (CVE-2019-0136)
    
    It was discovered that the Linux kernel on ARM processors allowed a tracing
    process to modify a syscall after a seccomp decision had been made on that
    syscall. A local attacker could possibly use this to bypass seccomp
    restrictions. (CVE-2019-2054)
    
    It was discovered that an integer overflow existed in the Binder
    implementation of the Linux kernel, leading to a buffer overflow. A local
    attacker could use this to escalate privileges. (CVE-2019-2181)
    
    It was discovered that the Marvell Wireless LAN device driver in the Linux
    kernel did not properly validate the BSS descriptor. A local attacker could
    possibly use this to cause a denial of service (system crash) or possibly
    execute arbitrary code. (CVE-2019-3846)
    
    It was discovered that a heap buffer overflow existed in the Marvell
    Wireless LAN device driver for the Linux kernel. An attacker could use this
    to cause a denial of service (system crash) or possibly execute arbitrary
    code. (CVE-2019-10126)
    
    It was discovered that the Bluetooth UART implementation in the Linux
    kernel did not properly check for missing tty operations. A local attacker
    could use this to cause a denial of service. (CVE-2019-10207)
    
    Jonathan Looney discovered that an integer overflow existed in the Linux
    kernel when handling TCP Selective Acknowledgments (SACKs). A remote
    attacker could use this to cause a denial of service (system crash). 
    (CVE-2019-11477)
    
    Jonathan Looney discovered that the TCP retransmission queue implementation
    in the Linux kernel could be fragmented when handling certain TCP Selective
    Acknowledgment (SACK) sequences. A remote attacker could use this to cause
    a denial of service. (CVE-2019-11478)
    
    It was discovered that the ext4 file system implementation in the Linux
    kernel did not properly zero out memory in some situations. A local
    attacker could use this to expose sensitive information (kernel memory). 
    (CVE-2019-11833)
    
    It was discovered that the PowerPC dlpar implementation in the Linux kernel
    did not properly check for allocation errors in some situations. A local
    attacker could possibly use this to cause a denial of service (system
    crash). (CVE-2019-12614)
    
    It was discovered that the floppy driver in the Linux kernel did not
    properly validate meta data, leading to a buffer overread. A local attacker
    could use this to cause a denial of service (system crash). 
    (CVE-2019-14283)
    
    It was discovered that the floppy driver in the Linux kernel did not
    properly validate ioctl() calls, leading to a division-by-zero. A local
    attacker could use this to cause a denial of service (system crash). 
    (CVE-2019-14284)
    
    Wen Huang discovered that the Marvell Wi-Fi device driver in the Linux
    kernel did not properly perform bounds checking, leading to a heap
    overflow. A local attacker could use this to cause a denial of service
    (system crash) or possibly execute arbitrary code. (CVE-2019-14814)
    
    Wen Huang discovered that the Marvell Wi-Fi device driver in the Linux
    kernel did not properly perform bounds checking, leading to a heap
    overflow. A local attacker could use this to cause a denial of service
    (system crash) or possibly execute arbitrary code. (CVE-2019-14815)
    
    Wen Huang discovered that the Marvell Wi-Fi device driver in the Linux
    kernel did not properly perform bounds checking, leading to a heap
    overflow. A local attacker could use this to cause a denial of service
    (system crash) or possibly execute arbitrary code. (CVE-2019-14816)
    
    Matt Delco discovered that the KVM hypervisor implementation in the Linux
    kernel did not properly perform bounds checking when handling coalesced
    MMIO write operations. A local attacker with write access to /dev/kvm could
    use this to cause a denial of service (system crash). (CVE-2019-14821)
    
    Peter Pi discovered a buffer overflow in the virtio network backend
    (vhost_net) implementation in the Linux kernel. An attacker in a guest may
    be able to use this to cause a denial of service (host OS crash) or
    possibly execute arbitrary code in the host OS. (CVE-2019-14835)
    
    Update instructions:
    
    The problem can be corrected by updating your livepatches to the following
    versions:
    
    | Kernel                   | Version  | flavors                  |
    |--------------------------+----------+--------------------------|
    | 4.4.0-148.174            | 58.1     | lowlatency, generic      |
    | 4.4.0-148.174~14.04.1    | 58.1     | lowlatency, generic      |
    | 4.4.0-150.176            | 58.1     | generic, lowlatency      |
    | 4.4.0-150.176~14.04.1    | 58.1     | lowlatency, generic      |
    | 4.4.0-151.178            | 58.1     | lowlatency, generic      |
    | 4.4.0-151.178~14.04.1    | 58.1     | generic, lowlatency      |
    | 4.4.0-154.181            | 58.1     | lowlatency, generic      |
    | 4.4.0-154.181~14.04.1    | 58.1     | generic, lowlatency      |
    | 4.4.0-157.185            | 58.1     | lowlatency, generic      |
    | 4.4.0-157.185~14.04.1    | 58.1     | generic, lowlatency      |
    | 4.4.0-159.187            | 58.1     | lowlatency, generic      |
    | 4.4.0-159.187~14.04.1    | 58.1     | generic, lowlatency      |
    | 4.4.0-161.189            | 58.1     | lowlatency, generic      |
    | 4.4.0-161.189~14.04.1    | 58.1     | lowlatency, generic      |
    | 4.4.0-164.192            | 58.1     | lowlatency, generic      |
    | 4.4.0-164.192~14.04.1    | 58.1     | lowlatency, generic      |
    | 4.4.0-165.193            | 58.1     | generic, lowlatency      |
    | 4.4.0-1083.93            | 58.1     | aws                      |
    | 4.4.0-1084.94            | 58.1     | aws                      |
    | 4.4.0-1085.96            | 58.1     | aws                      |
    | 4.4.0-1087.98            | 58.1     | aws                      |
    | 4.4.0-1088.99            | 58.1     | aws                      |
    | 4.4.0-1090.101           | 58.1     | aws                      |
    | 4.4.0-1092.103           | 58.1     | aws                      |
    | 4.4.0-1094.105           | 58.1     | aws                      |
    | 4.15.0-50.54             | 58.1     | generic, lowlatency      |
    | 4.15.0-50.54~16.04.1     | 58.1     | generic, lowlatency      |
    | 4.15.0-51.55             | 58.1     | generic, lowlatency      |
    | 4.15.0-51.55~16.04.1     | 58.1     | generic, lowlatency      |
    | 4.15.0-52.56             | 58.1     | lowlatency, generic      |
    | 4.15.0-52.56~16.04.1     | 58.1     | generic, lowlatency      |
    | 4.15.0-54.58             | 58.1     | generic, lowlatency      |
    | 4.15.0-54.58~16.04.1     | 58.1     | generic, lowlatency      |
    | 4.15.0-55.60             | 58.1     | generic, lowlatency      |
    | 4.15.0-58.64             | 58.1     | generic, lowlatency      |
    | 4.15.0-58.64~16.04.1     | 58.1     | lowlatency, generic      |
    | 4.15.0-60.67             | 58.1     | lowlatency, generic      |
    | 4.15.0-60.67~16.04.1     | 58.1     | generic, lowlatency      |
    | 4.15.0-62.69             | 58.1     | generic, lowlatency      |
    | 4.15.0-62.69~16.04.1     | 58.1     | lowlatency, generic      |
    | 4.15.0-64.73             | 58.1     | generic, lowlatency      |
    | 4.15.0-64.73~16.04.1     | 58.1     | lowlatency, generic      |
    | 4.15.0-65.74             | 58.1     | lowlatency, generic      |
    | 4.15.0-1038.43           | 58.1     | oem                      |
    | 4.15.0-1039.41           | 58.1     | aws                      |
    | 4.15.0-1039.44           | 58.1     | oem                      |
    | 4.15.0-1040.42           | 58.1     | aws                      |
    | 4.15.0-1041.43           | 58.1     | aws                      |
    | 4.15.0-1043.45           | 58.1     | aws                      |
    | 4.15.0-1043.48           | 58.1     | oem                      |
    | 4.15.0-1044.46           | 58.1     | aws                      |
    | 4.15.0-1045.47           | 58.1     | aws                      |
    | 4.15.0-1045.50           | 58.1     | oem                      |
    | 4.15.0-1047.49           | 58.1     | aws                      |
    | 4.15.0-1047.51           | 58.1     | azure                    |
    | 4.15.0-1048.50           | 58.1     | aws                      |
    | 4.15.0-1049.54           | 58.1     | azure                    |
    | 4.15.0-1050.52           | 58.1     | aws                      |
    | 4.15.0-1050.55           | 58.1     | azure                    |
    | 4.15.0-1050.57           | 58.1     | oem                      |
    | 4.15.0-1051.53           | 58.1     | aws                      |
    | 4.15.0-1051.56           | 58.1     | azure                    |
    | 4.15.0-1052.57           | 58.1     | azure                    |
    | 4.15.0-1055.60           | 58.1     | azure                    |
    | 4.15.0-1056.61           | 58.1     | azure                    |
    | 4.15.0-1056.65           | 58.1     | oem                      |
    | 4.15.0-1057.62           | 58.1     | azure                    |
    | 4.15.0-1057.66           | 58.1     | oem                      |
    | 4.15.0-1059.64           | 58.1     | azure                    |
    | 5.0.0-1014.14~18.04.1    | 58.1     | azure                    |
    | 5.0.0-1016.17~18.04.1    | 58.1     | azure                    |
    | 5.0.0-1018.19~18.04.1    | 58.1     | azure                    |
    | 5.0.0-1020.21~18.04.1    | 58.1     | azure                    |
    
    Support Information:
    
    Kernels older than the levels listed below do not receive livepatch
    updates. Please upgrade your kernel as soon as possible.
    
    | Series           | Version          | Flavors                  |
    |------------------+------------------+--------------------------|
    | Ubuntu 18.04 LTS | 4.15.0-1039      | aws                      |
    | Ubuntu 16.04 LTS | 4.4.0-1083       | aws                      |
    | Ubuntu 18.04 LTS | 5.0.0-1000       | azure                    |
    | Ubuntu 16.04 LTS | 4.15.0-1047      | azure                    |
    | Ubuntu 18.04 LTS | 4.15.0-50        | generic lowlatency       |
    | Ubuntu 16.04 LTS | 4.15.0-50        | generic lowlatency       |
    | Ubuntu 14.04 LTS | 4.4.0-148        | generic lowlatency       |
    | Ubuntu 18.04 LTS | 4.15.0-1038      | oem                      |
    | Ubuntu 16.04 LTS | 4.4.0-148        | generic lowlatency       |
    
    References:
      CVE-2016-10905, CVE-2018-20856, CVE-2018-20961, CVE-2018-20976, 
      CVE-2018-21008, CVE-2019-0136, CVE-2019-2054, CVE-2019-2181, 
      CVE-2019-3846, CVE-2019-10126, CVE-2019-10207, CVE-2019-11477, 
      CVE-2019-11478, CVE-2019-11833, CVE-2019-12614, CVE-2019-14283, 
      CVE-2019-14284, CVE-2019-14814, CVE-2019-14815, CVE-2019-14816, 
      CVE-2019-14821, CVE-2019-14835
    
    
    -- 
    ubuntu-security-announce mailing list
    This email address is being protected from spambots. You need JavaScript enabled to view it.
    Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
    

    LinuxSecurity Poll

    Do you feel that the Lawful Access to Encrypted Data Act, which aims to force encryption backdoors, is a threat to US citizens' privacy?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/30-do-you-feel-that-the-lawful-access-to-encrypted-data-act-which-aims-to-force-encryption-backdoors-is-a-threat-to-privacy?task=poll.vote&format=json
    30
    radio
    [{"id":"106","title":"Yes - I am a privacy advocate and I am strongly opposed to this bill.","votes":"23","type":"x","order":"1","pct":95.83,"resources":[]},{"id":"107","title":"I'm undecided - it has its pros and cons.","votes":"1","type":"x","order":"2","pct":4.17,"resources":[]},{"id":"108","title":"No - I support this bill and feel that it will help protect against crime and threats to our national security. ","votes":"0","type":"x","order":"3","pct":0,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
    bottom 200

    Advisories

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.