==========================================================================
Kernel Live Patch Security Notice 0061-1
January 08, 2020

linux vulnerability
==========================================================================

A security issue affects these releases of Ubuntu:

| Series           | Base kernel  | Arch     | flavors          |
|------------------+--------------+----------+------------------|
| Ubuntu 18.04 LTS | 4.15.0       | amd64    | aws              |
| Ubuntu 18.04 LTS | 4.15.0       | amd64    | generic          |
| Ubuntu 18.04 LTS | 4.15.0       | amd64    | lowlatency       |
| Ubuntu 18.04 LTS | 4.15.0       | amd64    | oem              |
| Ubuntu 18.04 LTS | 5.0.0        | amd64    | azure            |
| Ubuntu 18.04 LTS | 5.0.0        | amd64    | gcp              |
| Ubuntu 16.04 LTS | 4.4.0        | amd64    | aws              |
| Ubuntu 16.04 LTS | 4.4.0        | amd64    | generic          |
| Ubuntu 16.04 LTS | 4.4.0        | amd64    | lowlatency       |
| Ubuntu 16.04 LTS | 4.15.0       | amd64    | azure            |
| Ubuntu 16.04 LTS | 4.15.0       | amd64    | generic          |
| Ubuntu 16.04 LTS | 4.15.0       | amd64    | lowlatency       |

Summary:

Several security issues were fixed in the kernel.

Software Description:
- linux: Linux kernel

Details:

It was discovered that a heap-based buffer overflow existed in the Marvell
WiFi-Ex Driver for the Linux kernel. A physically proximate attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2019-14895)

It was discovered that a heap-based buffer overflow existed in the Marvell
Libertas WLAN Driver for the Linux kernel. A physically proximate attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2019-14896)

It was discovered that a heap-based buffer overflow existed in the Marvell
Libertas WLAN Driver for the Linux kernel. A physically proximate attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2019-14897)

It was discovered that a heap-based buffer overflow existed in the Marvell
WiFi-Ex Driver for the Linux kernel. A physically proximate attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2019-14901)

Jann Horn discovered that the OverlayFS and ShiftFS Drivers in the Linux
kernel did not properly handle reference counting during memory mapping
operations when used in conjunction with AUFS. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2019-15794)

Update instructions:

The problem can be corrected by updating your livepatches to the following
versions:

| Kernel                   | Version  | flavors                  |
|--------------------------+----------+--------------------------|
| 4.4.0-168.197            | 61.1     | generic, lowlatency      |
| 4.4.0-169.198            | 61.1     | generic, lowlatency      |
| 4.4.0-170.199            | 61.1     | lowlatency, generic      |
| 4.4.0-1098.109           | 61.1     | aws                      |
| 4.15.0-69.78             | 61.1     | generic, lowlatency      |
| 4.15.0-69.78~16.04.1     | 61.1     | lowlatency, generic      |
| 4.15.0-70.79             | 61.1     | lowlatency, generic      |
| 4.15.0-70.79~16.04.1     | 61.1     | generic, lowlatency      |
| 4.15.0-72.81             | 61.1     | generic, lowlatency      |
| 4.15.0-72.81~16.04.1     | 61.1     | generic, lowlatency      |
| 4.15.0-1054.56           | 61.1     | aws                      |
| 4.15.0-1063.68           | 61.1     | azure                    |
| 4.15.0-1063.72           | 61.1     | oem                      |
| 4.15.0-1064.73           | 61.1     | oem                      |
| 4.15.0-1065.75           | 61.1     | oem                      |
| 5.0.0-1025.26~18.04.1    | 61.1     | gcp                      |
| 5.0.0-1025.27~18.04.1    | 61.1     | azure                    |

Support Information:

Kernels older than the levels listed below do not receive livepatch
updates. Please upgrade your kernel as soon as possible.

| Series           | Version          | Flavors                  |
|------------------+------------------+--------------------------|
| Ubuntu 18.04 LTS | 4.15.0-1054      | aws                      |
| Ubuntu 16.04 LTS | 4.4.0-1098       | aws                      |
| Ubuntu 18.04 LTS | 5.0.0-1025       | azure                    |
| Ubuntu 16.04 LTS | 4.15.0-1063      | azure                    |
| Ubuntu 18.04 LTS | 4.15.0-69        | generic lowlatency       |
| Ubuntu 18.04 LTS | 5.0.0-1025       | gcp                      |
| Ubuntu 16.04 LTS | 4.15.0-69        | generic lowlatency       |
| Ubuntu 14.04 LTS | 4.4.0-168        | generic lowlatency       |
| Ubuntu 18.04 LTS | 4.15.0-1063      | oem                      |
| Ubuntu 16.04 LTS | 4.4.0-168        | generic lowlatency       |

References:
  CVE-2019-14895, CVE-2019-14896, CVE-2019-14897, CVE-2019-14901, 
  CVE-2019-15794


-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce