==========================================================================
Kernel Live Patch Security Notice 0041-1
August 06, 2018

linux vulnerability
==========================================================================

A security issue affects these releases of Ubuntu:

| Series           | Base kernel  | Arch     | flavors          |
|------------------+--------------+----------+------------------|
| Ubuntu 14.04 LTS | 4.4.0        | amd64    | generic          |
| Ubuntu 14.04 LTS | 4.4.0        | amd64    | lowlatency       |
| Ubuntu 16.04 LTS | 4.4.0        | amd64    | generic          |
| Ubuntu 16.04 LTS | 4.4.0        | amd64    | lowlatency       |
| Ubuntu 18.04 LTS | 4.15.0       | amd64    | generic          |
| Ubuntu 18.04 LTS | 4.15.0       | amd64    | lowlatency       |

Summary:

Several security issues were fixed in the kernel.

Software Description:
- linux: Linux kernel

Details:

The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel
through 4.16.12 allows local users to cause a denial of service
(stack-based buffer overflow) or possibly have unspecified other impact 
because sense buffers have different sizes at the CDROM layer and the SCSI
layer, as demonstrated by a CDROMREADMODE2 ioctl call. (CVE-2018-11506)

Wen Xu discovered that the ext4 file system implementation in the Linux
kernel did not properly initialize the crc32c checksum driver. A local
attacker could use this to cause a denial of service (system crash). 
(CVE-2018-1094)

The inode_init_owner function in fs/inode.c in the Linux kernel through
4.17.4 allows local users to create files with an unintended group ownership,
in a scenario where a directory is SGID to a certain group and is writable
by a user who is not a member of that group. Here, the non-member can trigger
creation of a plain file whose group ownership is that group. The intended
behavior was that the non-member can trigger creation of a directory
(but not a plain file) whose group ownership is that group. The non-member
can escalate privileges by making the plain file executable and SGID.
(CVE-2018-13405)

An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel
through 4.17.3. An OOPS may occur for a corrupted xfs image after 
xfs_da_shrink_inode() is called with a NULL bp. (CVE-2018-13094)

Juha-Matti Tilli discovered that the TCP implementation in the Linux kernel
performed algorithmically expensive operations in some situations when
handling incoming packets. A remote attacker could use this to cause a
denial of service. (CVE-2018-5390)

Update instructions:

The problem can be corrected by updating your livepatches to the following
versions:

| Kernel                   | Version  | flavors                  |
|--------------------------+----------+--------------------------|
| 4.4.0-124.148            | 41.2     | lowlatency, generic      |
| 4.4.0-124.148~14.04.1    | 41.2     | generic, lowlatency      |
| 4.4.0-127.153            | 41.2     | lowlatency, generic      |
| 4.4.0-127.153~14.04.1    | 41.2     | lowlatency, generic      |
| 4.4.0-128.154            | 41.2     | generic, lowlatency      |
| 4.4.0-128.154~14.04.1    | 41.2     | generic, lowlatency      |
| 4.4.0-130.156            | 41.2     | generic, lowlatency      |
| 4.4.0-130.156~14.04.1    | 41.2     | lowlatency, generic      |
| 4.4.0-131.157            | 41.2     | lowlatency, generic      |
| 4.4.0-131.157~14.04.1    | 41.2     | lowlatency, generic      |
| 4.15.0-20.21             | 41.2     | generic, lowlatency      |
| 4.15.0-22.24             | 41.2     | lowlatency, generic      |
| 4.15.0-23.25             | 41.2     | lowlatency, generic      |
| 4.15.0-24.26             | 41.2     | lowlatency, generic      |
| 4.15.0-29.31             | 41.2     | generic, lowlatency      |

References:
  CVE-2018-11506, CVE-2018-1094, CVE-2018-13405, CVE-2018-13094,
  CVE-2018-5390

-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce