=========================================================================Kernel Live Patch Security Notice 0071-1
September 10, 2020

linux vulnerability
=========================================================================A security issue affects these releases of Ubuntu and its derivatives:

-   Ubuntu 16.04 LTS
-   Ubuntu 18.04 LTS
-   Ubuntu 20.04 LTS

Summary

A security issue was fixed in the 4.15 kernel. This issue affects the
5.4 kernel as well, but a livepatch is not yet available. While work is
continuing to develop livepatches for all affected kernels, due to the
severity of the issue, we are releasing patches as they become ready.

Software Description

-   linux - Linux kernel
-   linux-aws - Linux kernel for Amazon Web Services (AWS) systems
-   linux-oem - Linux kernel for OEM systems

Details

Or Cohen discovered that the AF_PACKET implementation in the Linux
kernel did not properly perform bounds checking in some situations. A
local attacker could use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2020-14386)


Update instructions

The problem can be corrected by updating your kernel livepatch to the
following versions:

Ubuntu 18.04 LTS
    aws - 71.1
    generic - 71.1
    lowlatency - 71.1
    oem - 71.1

A mitigation is available if your kernel is affected, did not yet
receive a livepatch, and rebooting into the most recently released
kernel is not practical. If your system does not require the use of
unprivileged user namespaces, you may disable them and mitigate the
problem using the following command:

    sudo sysctl kernel.unprivileged_userns_clone=0


Support Information

Kernels older than the levels listed below do not receive livepatch
updates. If you are running a kernel version earlier than the one listed
below, please upgrade your kernel as soon as possible.

Ubuntu 18.04 LTS
    linux-aws - 4.15.0-1054
    linux-oem - 4.15.0-1063
    linux - 4.15.0-69

Ubuntu 16.04 LTS
    linux-azure - 4.15.0-1063


References

-   CVE-2020-14386


-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce