exploit the possibilities

Kernel Live Patch Security Notice LSN-0058-1

Kernel Live Patch Security Notice LSN-0058-1
Posted Oct 23, 2019
Authored by Benjamin M. Romer

It was discovered that a race condition existed in the GFS2 file system in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash). It was discovered that a use-after-free error existed in the block layer subsystem of the Linux kernel when certain failure conditions occurred. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. Various other issues were also addressed.

tags | advisory, denial of service, arbitrary, kernel, local
systems | linux
advisories | CVE-2016-10905, CVE-2018-20856, CVE-2018-20961, CVE-2018-20976, CVE-2018-21008, CVE-2019-0136, CVE-2019-10126, CVE-2019-10207, CVE-2019-11477, CVE-2019-11478, CVE-2019-11833, CVE-2019-12614, CVE-2019-14283, CVE-2019-14284, CVE-2019-14814, CVE-2019-14815, CVE-2019-14816, CVE-2019-14821, CVE-2019-14835, CVE-2019-2054, CVE-2019-2181, CVE-2019-3846
MD5 | aa1b2d5e0e41264715ab20ee76ffa47d

Kernel Live Patch Security Notice LSN-0058-1

Change Mirror Download
==========================================================================
Kernel Live Patch Security Notice 0058-1
October 22, 2019

linux vulnerability
==========================================================================

A security issue affects these releases of Ubuntu:

| Series | Base kernel | Arch | flavors |
|------------------+--------------+----------+------------------|
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | aws |
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | generic |
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | lowlatency |
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | oem |
| Ubuntu 18.04 LTS | 5.0.0 | amd64 | azure |
| Ubuntu 14.04 LTS | 4.4.0 | amd64 | generic |
| Ubuntu 14.04 LTS | 4.4.0 | amd64 | lowlatency |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | aws |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | generic |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | lowlatency |
| Ubuntu 16.04 LTS | 4.15.0 | amd64 | azure |
| Ubuntu 16.04 LTS | 4.15.0 | amd64 | generic |
| Ubuntu 16.04 LTS | 4.15.0 | amd64 | lowlatency |

Summary:

Several security issues were fixed in the kernel.

Software Description:
- linux: Linux kernel

Details:

It was discovered that a race condition existed in the GFS2 file system in
the Linux kernel. A local attacker could possibly use this to cause a
denial of service (system crash). (CVE-2016-10905)

It was discovered that a use-after-free error existed in the block layer
subsystem of the Linux kernel when certain failure conditions occurred. A
local attacker could possibly use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2018-20856)

It was discovered that the USB gadget Midi driver in the Linux kernel
contained a double-free vulnerability when handling certain error
conditions. A local attacker could use this to cause a denial of service
(system crash). (CVE-2018-20961)

It was discovered that the XFS file system in the Linux kernel did not
properly handle mount failures in some situations. A local attacker could
possibly use this to cause a denial of service (system crash) or execute
arbitrary code. (CVE-2018-20976)

It was discovered that the RSI 91x Wi-Fi driver in the Linux kernel did not
did not handle detach operations correctly, leading to a use-after-free
vulnerability. A physically proximate attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2018-21008)

It was discovered that the Intel Wi-Fi device driver in the Linux kernel
did not properly validate certain Tunneled Direct Link Setup (TDLS). A
physically proximate attacker could use this to cause a denial of service
(Wi-Fi disconnect). (CVE-2019-0136)

It was discovered that the Linux kernel on ARM processors allowed a tracing
process to modify a syscall after a seccomp decision had been made on that
syscall. A local attacker could possibly use this to bypass seccomp
restrictions. (CVE-2019-2054)

It was discovered that an integer overflow existed in the Binder
implementation of the Linux kernel, leading to a buffer overflow. A local
attacker could use this to escalate privileges. (CVE-2019-2181)

It was discovered that the Marvell Wireless LAN device driver in the Linux
kernel did not properly validate the BSS descriptor. A local attacker could
possibly use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2019-3846)

It was discovered that a heap buffer overflow existed in the Marvell
Wireless LAN device driver for the Linux kernel. An attacker could use this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2019-10126)

It was discovered that the Bluetooth UART implementation in the Linux
kernel did not properly check for missing tty operations. A local attacker
could use this to cause a denial of service. (CVE-2019-10207)

Jonathan Looney discovered that an integer overflow existed in the Linux
kernel when handling TCP Selective Acknowledgments (SACKs). A remote
attacker could use this to cause a denial of service (system crash).
(CVE-2019-11477)

Jonathan Looney discovered that the TCP retransmission queue implementation
in the Linux kernel could be fragmented when handling certain TCP Selective
Acknowledgment (SACK) sequences. A remote attacker could use this to cause
a denial of service. (CVE-2019-11478)

It was discovered that the ext4 file system implementation in the Linux
kernel did not properly zero out memory in some situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2019-11833)

It was discovered that the PowerPC dlpar implementation in the Linux kernel
did not properly check for allocation errors in some situations. A local
attacker could possibly use this to cause a denial of service (system
crash). (CVE-2019-12614)

It was discovered that the floppy driver in the Linux kernel did not
properly validate meta data, leading to a buffer overread. A local attacker
could use this to cause a denial of service (system crash).
(CVE-2019-14283)

It was discovered that the floppy driver in the Linux kernel did not
properly validate ioctl() calls, leading to a division-by-zero. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2019-14284)

Wen Huang discovered that the Marvell Wi-Fi device driver in the Linux
kernel did not properly perform bounds checking, leading to a heap
overflow. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2019-14814)

Wen Huang discovered that the Marvell Wi-Fi device driver in the Linux
kernel did not properly perform bounds checking, leading to a heap
overflow. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2019-14815)

Wen Huang discovered that the Marvell Wi-Fi device driver in the Linux
kernel did not properly perform bounds checking, leading to a heap
overflow. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2019-14816)

Matt Delco discovered that the KVM hypervisor implementation in the Linux
kernel did not properly perform bounds checking when handling coalesced
MMIO write operations. A local attacker with write access to /dev/kvm could
use this to cause a denial of service (system crash). (CVE-2019-14821)

Peter Pi discovered a buffer overflow in the virtio network backend
(vhost_net) implementation in the Linux kernel. An attacker in a guest may
be able to use this to cause a denial of service (host OS crash) or
possibly execute arbitrary code in the host OS. (CVE-2019-14835)

Update instructions:

The problem can be corrected by updating your livepatches to the following
versions:

| Kernel | Version | flavors |
|--------------------------+----------+--------------------------|
| 4.4.0-148.174 | 58.1 | lowlatency, generic |
| 4.4.0-148.174~14.04.1 | 58.1 | lowlatency, generic |
| 4.4.0-150.176 | 58.1 | generic, lowlatency |
| 4.4.0-150.176~14.04.1 | 58.1 | lowlatency, generic |
| 4.4.0-151.178 | 58.1 | lowlatency, generic |
| 4.4.0-151.178~14.04.1 | 58.1 | generic, lowlatency |
| 4.4.0-154.181 | 58.1 | lowlatency, generic |
| 4.4.0-154.181~14.04.1 | 58.1 | generic, lowlatency |
| 4.4.0-157.185 | 58.1 | lowlatency, generic |
| 4.4.0-157.185~14.04.1 | 58.1 | generic, lowlatency |
| 4.4.0-159.187 | 58.1 | lowlatency, generic |
| 4.4.0-159.187~14.04.1 | 58.1 | generic, lowlatency |
| 4.4.0-161.189 | 58.1 | lowlatency, generic |
| 4.4.0-161.189~14.04.1 | 58.1 | lowlatency, generic |
| 4.4.0-164.192 | 58.1 | lowlatency, generic |
| 4.4.0-164.192~14.04.1 | 58.1 | lowlatency, generic |
| 4.4.0-165.193 | 58.1 | generic, lowlatency |
| 4.4.0-1083.93 | 58.1 | aws |
| 4.4.0-1084.94 | 58.1 | aws |
| 4.4.0-1085.96 | 58.1 | aws |
| 4.4.0-1087.98 | 58.1 | aws |
| 4.4.0-1088.99 | 58.1 | aws |
| 4.4.0-1090.101 | 58.1 | aws |
| 4.4.0-1092.103 | 58.1 | aws |
| 4.4.0-1094.105 | 58.1 | aws |
| 4.15.0-50.54 | 58.1 | generic, lowlatency |
| 4.15.0-50.54~16.04.1 | 58.1 | generic, lowlatency |
| 4.15.0-51.55 | 58.1 | generic, lowlatency |
| 4.15.0-51.55~16.04.1 | 58.1 | generic, lowlatency |
| 4.15.0-52.56 | 58.1 | lowlatency, generic |
| 4.15.0-52.56~16.04.1 | 58.1 | generic, lowlatency |
| 4.15.0-54.58 | 58.1 | generic, lowlatency |
| 4.15.0-54.58~16.04.1 | 58.1 | generic, lowlatency |
| 4.15.0-55.60 | 58.1 | generic, lowlatency |
| 4.15.0-58.64 | 58.1 | generic, lowlatency |
| 4.15.0-58.64~16.04.1 | 58.1 | lowlatency, generic |
| 4.15.0-60.67 | 58.1 | lowlatency, generic |
| 4.15.0-60.67~16.04.1 | 58.1 | generic, lowlatency |
| 4.15.0-62.69 | 58.1 | generic, lowlatency |
| 4.15.0-62.69~16.04.1 | 58.1 | lowlatency, generic |
| 4.15.0-64.73 | 58.1 | generic, lowlatency |
| 4.15.0-64.73~16.04.1 | 58.1 | lowlatency, generic |
| 4.15.0-65.74 | 58.1 | lowlatency, generic |
| 4.15.0-1038.43 | 58.1 | oem |
| 4.15.0-1039.41 | 58.1 | aws |
| 4.15.0-1039.44 | 58.1 | oem |
| 4.15.0-1040.42 | 58.1 | aws |
| 4.15.0-1041.43 | 58.1 | aws |
| 4.15.0-1043.45 | 58.1 | aws |
| 4.15.0-1043.48 | 58.1 | oem |
| 4.15.0-1044.46 | 58.1 | aws |
| 4.15.0-1045.47 | 58.1 | aws |
| 4.15.0-1045.50 | 58.1 | oem |
| 4.15.0-1047.49 | 58.1 | aws |
| 4.15.0-1047.51 | 58.1 | azure |
| 4.15.0-1048.50 | 58.1 | aws |
| 4.15.0-1049.54 | 58.1 | azure |
| 4.15.0-1050.52 | 58.1 | aws |
| 4.15.0-1050.55 | 58.1 | azure |
| 4.15.0-1050.57 | 58.1 | oem |
| 4.15.0-1051.53 | 58.1 | aws |
| 4.15.0-1051.56 | 58.1 | azure |
| 4.15.0-1052.57 | 58.1 | azure |
| 4.15.0-1055.60 | 58.1 | azure |
| 4.15.0-1056.61 | 58.1 | azure |
| 4.15.0-1056.65 | 58.1 | oem |
| 4.15.0-1057.62 | 58.1 | azure |
| 4.15.0-1057.66 | 58.1 | oem |
| 4.15.0-1059.64 | 58.1 | azure |
| 5.0.0-1014.14~18.04.1 | 58.1 | azure |
| 5.0.0-1016.17~18.04.1 | 58.1 | azure |
| 5.0.0-1018.19~18.04.1 | 58.1 | azure |
| 5.0.0-1020.21~18.04.1 | 58.1 | azure |

Support Information:

Kernels older than the levels listed below do not receive livepatch
updates. Please upgrade your kernel as soon as possible.

| Series | Version | Flavors |
|------------------+------------------+--------------------------|
| Ubuntu 18.04 LTS | 4.15.0-1039 | aws |
| Ubuntu 16.04 LTS | 4.4.0-1083 | aws |
| Ubuntu 18.04 LTS | 5.0.0-1000 | azure |
| Ubuntu 16.04 LTS | 4.15.0-1047 | azure |
| Ubuntu 18.04 LTS | 4.15.0-50 | generic lowlatency |
| Ubuntu 16.04 LTS | 4.15.0-50 | generic lowlatency |
| Ubuntu 14.04 LTS | 4.4.0-148 | generic lowlatency |
| Ubuntu 18.04 LTS | 4.15.0-1038 | oem |
| Ubuntu 16.04 LTS | 4.4.0-148 | generic lowlatency |

References:
CVE-2016-10905, CVE-2018-20856, CVE-2018-20961, CVE-2018-20976,
CVE-2018-21008, CVE-2019-0136, CVE-2019-2054, CVE-2019-2181,
CVE-2019-3846, CVE-2019-10126, CVE-2019-10207, CVE-2019-11477,
CVE-2019-11478, CVE-2019-11833, CVE-2019-12614, CVE-2019-14283,
CVE-2019-14284, CVE-2019-14814, CVE-2019-14815, CVE-2019-14816,
CVE-2019-14821, CVE-2019-14835


--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

December 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    1 Files
  • 2
    Dec 2nd
    16 Files
  • 3
    Dec 3rd
    17 Files
  • 4
    Dec 4th
    23 Files
  • 5
    Dec 5th
    11 Files
  • 6
    Dec 6th
    10 Files
  • 7
    Dec 7th
    1 Files
  • 8
    Dec 8th
    1 Files
  • 9
    Dec 9th
    15 Files
  • 10
    Dec 10th
    30 Files
  • 11
    Dec 11th
    8 Files
  • 12
    Dec 12th
    20 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close