Several security issues were fixed in the Linux kernel.. =========================================================================Ubuntu Security Notice USN-4008-3 June 07, 2019 linux-lts-xenial, linux-aws vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 ESM Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux-aws: Linux kernel for Amazon Web Services (AWS) systems - linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty Details: USN-4008-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 ESM. Robert Święcki discovered that the Linux kernel did not properly apply Address Space Layout Randomization (ASLR) in some situations for setuid elf binaries. A local attacker could use this to improve the chances of exploiting an existing vulnerability in a setuid elf binary. (CVE-2019-11190) It was discovered that a null pointer dereference vulnerability existed in the LSI Logic MegaRAID driver in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-11810) It was discovered that a race condition leading to a use-after-free existed in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel. The RDS protocol is blacklisted by default in Ubuntu. If enabled, a local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-11815) Federico Manuel Bento discovered that the Linux kernel did not properly apply Address Space Layout Randomization (ASLR) in some situations for setuid a.out binaries. A local attacker could use this to improve the chances of exploiting an existing vulnerability in a setuid a.outbinary. (CVE-2019-11191) As a hardening measure, this update disables a.out support. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 ESM: linux-image-4.4.0-1045-aws 4.4.0-1045.48 linux-image-4.4.0-150-generic 4.4.0-150.176~14.04.1 linux-image-4.4.0-150-generic-lpae 4.4.0-150.176~14.04.1 linux-image-4.4.0-150-lowlatency 4.4.0-150.176~14.04.1 linux-image-aws 4.4.0.1045.46 linux-image-generic-lpae-lts-xenial 4.4.0.150.132 linux-image-generic-lts-xenial 4.4.0.150.132 linux-image-lowlatency-lts-xenial 4.4.0.150.132 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-4008-3 https://ubuntu.com/security/notices/USN-4008-1 CVE-2019-11190, CVE-2019-11191, CVE-2019-11810, CVE-2019-11815 . Critical patch release for Ubuntu kernel flaws on June 07, 2019, mitigating local exploitation threats through updates and corrective measures.. Linux Kernel, Security Update, Ubuntu Vulnerabilities, AWS Kernels, System Security. . Severity: Critical. LinuxSecurity.com Team
A system hardening measure could be bypassed.. =========================================================================Ubuntu Security Notice USN-4007-1 June 04, 2019 linux, linux-aws, linux-gcp, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS Summary: A system hardening measure could be bypassed. Software Description: - linux: Linux kernel - linux-aws: Linux kernel for Amazon Web Services (AWS) systems - linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems - linux-kvm: Linux kernel for cloud environments - linux-meta: - linux-oem: Linux kernel for OEM processors - linux-oracle: Linux kernel for Oracle Cloud systems - linux-raspi2: Linux kernel for Raspberry Pi 2 - linux-snapdragon: Linux kernel for Snapdragon processors Details: Federico Manuel Bento discovered that the Linux kernel did not properly apply Address Space Layout Randomization (ASLR) in some situations for setuid a.out binaries. A local attacker could use this to improve the chances of exploiting an existing vulnerability in a setuid a.out binary. As a hardening measure, this update disables a.out support. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS: linux-image-4.15.0-1014-oracle 4.15.0-1014.16 linux-image-4.15.0-1033-gcp 4.15.0-1033.35 linux-image-4.15.0-1035-kvm 4.15.0-1035.35 linux-image-4.15.0-1037-raspi2 4.15.0-1037.39 linux-image-4.15.0-1039-oem 4.15.0-1039.44 linux-image-4.15.0-1040-aws 4.15.0-1040.42 linux-image-4.15.0-1054-snapdragon 4.15.0-1054.58 linux-image-4.15.0-51-generic 4.15.0-51.55 linux-image-4.15.0-51-generic-lpae 4.15.0-51.55 linux-image-4.15.0-51-lowlatency 4.15.0-51.55 linux-image-aws 4.15.0.1040.39 linux-image-gcp 4.15.0.1033.35 linux-image-generic 4.15.0.51.53 linux-image-generic-lpae 4.15.0.51.53 linux-image-kvm 4.15.0.1035.35 linux-image-lowlatency 4.15.0.51.53 linux-image-oem 4.15.0.1039.43 linux-image-oracle 4.15.0.1014.17 linux-image-raspi2 4.15.0.1037.35 linux-image-snapdragon 4.15.0.1054.57 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-4007-1 CVE-2019-11191 Package Information: https://launchpad.net/ubuntu/+source/linux/4.15.0-51.55 https://launchpad.net/ubuntu/+source/linux-aws/4.15.0-1040.42 https://launchpad.net/ubuntu/+source/linux-gcp/4.15.0-1033.35 https://launchpad.net/ubuntu/+source/linux-kvm/4.15.0-1035.35 https://launchpad.net/ubuntu/+source/linux-meta/4.15.0.51.53 https://launchpad.net/ubuntu/+source/linux-oem/4.15.0-1039.44 https://launchpad.net/ubuntu/+source/linux-oracle/4.15.0-1014.16 https://launchpad.net/ubuntu/+source/linux-raspi2/4.15.0-1037.39 https://launchpad.net/ubuntu/+source/linux-snapdragon/4.15.0-1054.58 . Critical security notice for Ubuntu regarding a circumvention of kernel protection protocols impacting various deployments.. Ubuntu Security, Linux Kernel Issues, System Hardening, ASLR Bypass, Setuid Exploit. . Severity: Critical. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.