drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in Linux
Name: |
Mehrere Probleme in Linux |
|
ID: |
USN-3835-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 18.10 |
|
Datum: |
Mo, 3. Dezember 2018, 22:29 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6559
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18653
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18955
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18445
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17972
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18281 |
|
Applikationen: |
Linux |
|
Originalnachricht |
--===============8713271062129786004== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="1Y7d0dPL928TPQbc" Content-Disposition: inline
--1Y7d0dPL928TPQbc Content-Type: text/plain; charset=us-ascii Content-Disposition: inline
========================================================================== Ubuntu Security Notice USN-3835-1 December 03, 2018
linux, linux-gcp, linux-kvm, linux-raspi2 vulnerabilities ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.10
Summary:
Several security issues were fixed in the Linux kernel.
Software Description: - linux: Linux kernel - linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems - linux-kvm: Linux kernel for cloud environments - linux-raspi2: Linux kernel for Raspberry Pi 2
Details:
Jann Horn discovered that the procfs file system implementation in the Linux kernel did not properly restrict the ability to inspect the kernel stack of an arbitrary task. A local attacker could use this to expose sensitive information. (CVE-2018-17972)
Jann Horn discovered that the mremap() system call in the Linux kernel did not properly flush the TLB when completing, potentially leaving access to a physical page after it has been released to the page allocator. A local attacker could use this to cause a denial of service (system crash), expose sensitive information, or possibly execute arbitrary code. (CVE-2018-18281)
It was discovered that the BPF verifier in the Linux kernel did not correctly compute numeric bounds in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-18445)
Daniel Dadap discovered that the module loading implementation in the Linux kernel did not properly enforce signed module loading when booted with UEFI Secure Boot in some situations. A local privileged attacker could use this to execute untrusted code in the kernel. (CVE-2018-18653)
Jann Horn discovered that the Linux kernel mishandles mapping UID or GID ranges inside nested user namespaces in some situations. A local attacker could use this to bypass access controls on resources outside the namespace. (CVE-2018-18955)
Philipp Wendler discovered that the overlayfs implementation in the Linux kernel did not properly verify the directory contents permissions from within a unprivileged user namespace. A local attacker could use this to expose sensitive information (protected file names). (CVE-2018-6559)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 18.10: linux-image-4.18.0-1004-gcp 4.18.0-1004.5 linux-image-4.18.0-1005-kvm 4.18.0-1005.5 linux-image-4.18.0-1007-raspi2 4.18.0-1007.9 linux-image-4.18.0-12-generic 4.18.0-12.13 linux-image-4.18.0-12-generic-lpae 4.18.0-12.13 linux-image-4.18.0-12-lowlatency 4.18.0-12.13 linux-image-4.18.0-12-snapdragon 4.18.0-12.13 linux-image-gcp 4.18.0.1004.4 linux-image-generic 4.18.0.12.13 linux-image-generic-lpae 4.18.0.12.13 linux-image-gke 4.18.0.1004.4 linux-image-kvm 4.18.0.1005.5 linux-image-lowlatency 4.18.0.12.13 linux-image-raspi2 4.18.0.1007.4 linux-image-snapdragon 4.18.0.12.13
After a standard system update you need to reboot your computer to make all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well.
References: https://usn.ubuntu.com/usn/usn-3835-1 CVE-2018-17972, CVE-2018-18281, CVE-2018-18445, CVE-2018-18653, CVE-2018-18955, CVE-2018-6559
Package Information: https://launchpad.net/ubuntu/+source/linux/4.18.0-12.13 https://launchpad.net/ubuntu/+source/linux-gcp/4.18.0-1004.5 https://launchpad.net/ubuntu/+source/linux-kvm/4.18.0-1005.5 https://launchpad.net/ubuntu/+source/linux-raspi2/4.18.0-1007.9
--1Y7d0dPL928TPQbc Content-Type: application/pgp-signature; name="signature.asc"
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEpgY7tWAjCaQ8jrvULwmejQBegfQFAlwFj/gACgkQLwmejQBe gfR/RBAAhmPczNivnNHCwJLptzpeOxe/7wBoSHNXN2RvwyEpe12Wd5pSG1VC8mOQ NJ5fI8UAWDCmhizznEJGMqmeb4faTu9V+YENZHNX26G97xDp29HityGtaXCrKC6w Sk1h3xVjMqaWVPaFOASJzTarPMpaXZNwXNytBqCcMnvq0efR55MHzh1yrSnAPiL7 i9he/Isx/OyYjiCDbVlggM1Ggu26TPc8VAXf1uZEfdnMOzJMjjHiT68ipyFU6axb YRIaXpRxcMvZ7qmIX/yUFOBYS3l2euVuks2SyNxGCYMajnsiGdhMz1MRDQ2CepbI oHxr/4UgcRiTNaKzVpJQRb6BkIgJF44TIk4cs2/HkZ6lyRXn8a6mhqKppB5hvf2n A9auSrcloSWXdeeHbyHf1bqN5c/GhFmp6CbzqlqWAKe0BdxosTGXD9rk+BfkdjYJ na62G1ZXWkCGAWKejLMsI00UzONxNf6SAHbnJFizMRdkNkIX8daHUyiQQ/lP46BU n2CPV8nRPR7/tMtHMZjaO6dbw7q1Wk5w1IWfhrbmstfnkDqXfWDQg0DGvCDW1K0h qgj9gBLWjaQQOeLiSfsDDAqbm34kmOcb+kAOVqrG8m0f2rJfwHU9crUUQdOYcfHy HgSFacK4FIn9ft4JK0fHJMNMEeiHxy8p+16ylQ57tcBTDNm4J8U= =yr5H -----END PGP SIGNATURE-----
--1Y7d0dPL928TPQbc--
--===============8713271062129786004== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
|
|
|
|