--===============4901107381144814713==
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature";
boundary="sT9gWZPUZYhvPS56"
Content-Disposition: inline
--sT9gWZPUZYhvPS56
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
==========================================================================
Ubuntu Security Notice USN-3656-1
May 22, 2018
linux-raspi2, linux-snapdragon vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-raspi2: Linux kernel for Raspberry Pi 2
- linux-snapdragon: Linux kernel for Snapdragon processors
Details:
Tuba Yavuz discovered that a double-free error existed in the USBTV007
driver of the Linux kernel. A local attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2017-17975)
It was discovered that a race condition existed in the F2FS implementation
in the Linux kernel. A local attacker could use this to cause a denial of
service (system crash). (CVE-2017-18193)
It was discovered that a buffer overflow existed in the Hisilicon HNS
Ethernet Device driver in the Linux kernel. A local attacker could use this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2017-18222)
It was discovered that the netfilter subsystem in the Linux kernel did not
validate that rules containing jumps contained user-defined chains. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2018-1065)
It was discovered that the netfilter subsystem of the Linux kernel did not
properly validate ebtables offsets. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2018-1068)
It was discovered that a null pointer dereference vulnerability existed in
the DCCP protocol implementation in the Linux kernel. A local attacker
could use this to cause a denial of service (system crash). (CVE-2018-1130)
It was discovered that the SCTP Protocol implementation in the Linux kernel
did not properly validate userspace provided payload lengths in some
situations. A local attacker could use this to cause a denial of service
(system crash). (CVE-2018-5803)
It was discovered that a double free error existed in the block layer
subsystem of the Linux kernel when setting up a request queue. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2018-7480)
It was discovered that a memory leak existed in the SAS driver subsystem of
the Linux kernel. A local attacker could use this to cause a denial of
service (memory exhaustion). (CVE-2018-7757)
It was discovered that a race condition existed in the x86 machine check
handler in the Linux kernel. A local privileged attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2018-7995)
Eyal Itkin discovered that the USB displaylink video adapter driver in the
Linux kernel did not properly validate mmap offsets sent from userspace. A
local attacker could use this to expose sensitive information (kernel
memory) or possibly execute arbitrary code. (CVE-2018-8781)
Silvio Cesare discovered a buffer overwrite existed in the NCPFS
implementation in the Linux kernel. A remote attacker controlling a
malicious NCPFS server could use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2018-8822)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
linux-image-4.4.0-1090-raspi2 4.4.0-1090.98
linux-image-4.4.0-1093-snapdragon 4.4.0-1093.98
linux-image-raspi2 4.4.0.1090.90
linux-image-snapdragon 4.4.0.1093.85
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/usn/usn-3656-1
CVE-2017-17975, CVE-2017-18193, CVE-2017-18222, CVE-2018-1065,
CVE-2018-1068, CVE-2018-1130, CVE-2018-5803, CVE-2018-7480,
CVE-2018-7757, CVE-2018-7995, CVE-2018-8781, CVE-2018-8822
Package Information:
https://launchpad.net/ubuntu/+source/linux-raspi2/4.4.0-1090.98
https://launchpad.net/ubuntu/+source/linux-snapdragon/4.4.0-1093.98
--sT9gWZPUZYhvPS56
Content-Type: application/pgp-signature; name="signature.asc"
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEpgY7tWAjCaQ8jrvULwmejQBegfQFAlsEpqcACgkQLwmejQBe
gfRx1w//VjitaJy6N4q6I/OXlpJmmcoOlZNLZ+hWnAMfqRlxzkXjobIqQT7a2ss1
eM002xAiIu3eBfmNdSE1NR9djZUm/Yrpav/I2MhghjJU/g2W4U63qEpUlVVoUEqG
JrTMLlVuCRT1cN8FbZ1xHkY7r8YqM68XoC9of+I0UY7vnVk6jRERdqUH787SME/b
WiQd9TAhWC5r6qDqVRsEK6dtKmpPDFGKYilKfd/V8zb9Q4mQa1nVdGCTTUONZwrq
oVsjDCM6jzlQ7RMAqbz3jSesxdREZNLUKgm4aWXv4T0BS/HUKCckEpwvLgtBXFKC
T4IG7GvXUPDNiE2F12LRrGJ22/eQZ7iQPoWVkIsQ+eN5EIUt1aAXvuM/83oLbATL
12r6F+VqL/lCQT1zEle21jbB/ki4iYV2aNURpuWS/IGDOHWXzdjzGVGG7d2FHaoC
6eytmfJMW1+ZPtYnFdtTmcPnVkcvM5I3EDQNcrM4gElQHGqWwzZv9tb/tRYKVp3c
eFRWxIm5C5bYXp89oeESoSr3arUfJD0sRYmRTaHLTdLkTU0sKvy+QFzr7eHd6Ewh
d1IX3nJICd9MosmnNhpZlqX3tr6VDVEwHdVfUIdRqwDjS9MGRbly9kFTzsWgvQc/
NiIQ4eTl/6uWhoRtxO7OTTHMTSWPsd/NFmyIx0R0DBSz0a4q3Ho=
=vkPG
-----END PGP SIGNATURE-----
--sT9gWZPUZYhvPS56--
--===============4901107381144814713==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
|
