Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.3039
Linux kernel vulnerability
9 October 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: linux kernel
Publisher: Ubuntu
Operating System: Ubuntu
Impact/Access: Root Compromise -- Existing Account
Access Privileged Data -- Existing Account
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2018-17182 CVE-2018-15594 CVE-2018-15572
CVE-2018-14633 CVE-2018-6555 CVE-2018-3646
CVE-2018-3620
Reference: ASB-2018.0204
ESB-2018.3020
ESB-2018.2974
ESB-2018.2955
ESB-2018.2910
ESB-2018.2770
Original Bulletin:
https://lists.ubuntu.com/archives/ubuntu-security-announce/2018-October/004611.html
- --------------------------BEGIN INCLUDED TEXT--------------------
==========================================================================
Kernel Live Patch Security Notice 0044-1
October 05, 2018
linux vulnerability
==========================================================================
A security issue affects these releases of Ubuntu:
| Series | Base kernel | Arch | flavors |
|------------------+--------------+----------+------------------|
| Ubuntu 14.04 LTS | 4.4.0 | amd64 | generic |
| Ubuntu 14.04 LTS | 4.4.0 | amd64 | lowlatency |
| Ubuntu 16.04 LTS | 4.15.0 | amd64 | generic |
| Ubuntu 16.04 LTS | 4.15.0 | amd64 | lowlatency |
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | generic |
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | lowlatency |
Summary:
Several security issues were fixed in the kernel.
Note that due to a client issue, this livepatch may report that it failed to
load. You can verify that the patch has successfully loaded by looking in
/sys/kernel/livepatch for a directory starting with the name "lkp_Ubuntu,"
followed by your kernel version, and ending with the version number, "44."
The next client update should correct this problem.
Software Description:
- - linux: Linux kernel
Details:
It was discovered that memory present in the L1 data cache of an Intel CPU
core may be exposed to a malicious process that is executing on the CPU
core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local
attacker could use this to expose sensitive information (memory from the
kernel or other processes). (CVE-2018-3620)
It was discovered that the paravirtualization implementation in the Linux
kernel did not properly handle some indirect calls, reducing the
effectiveness of Spectre v2 mitigations for paravirtual guests. A local
attacker could use this to expose sensitive information. (CVE-2018-15594)
It was discovered that memory present in the L1 data cache of an Intel CPU
core may be exposed to a malicious process that is executing on the CPU
core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local
attacker in a guest virtual machine could use this to expose sensitive
information (memory from other guests or the host OS). (CVE-2018-3646)
It was discovered that a use-after-free vulnerability existed in the IRDA
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2018-6555)
It was discovered that a stack-based buffer overflow existed in the iSCSI
target implementation of the Linux kernel. A remote attacker could use this
to cause a denial of service (system crash). (CVE-2018-14633)
It was discovered that microprocessors utilizing speculative execution and
prediction of return addresses via Return Stack Buffer (RSB) may allow
unauthorized memory reads via sidechannel attacks. An attacker could use
this to expose sensitive information. (CVE-2018-15572)
Jann Horn discovered that the vmacache subsystem did not properly handle
sequence number overflows, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or execute arbitrary code. (CVE-2018-17182)
Update instructions:
The problem can be corrected by updating your livepatches to the following
versions:
| Kernel | Version | flavors |
|--------------------------+----------+--------------------------|
| 4.4.0-133.159 | 44.1 | generic, lowlatency |
| 4.4.0-133.159~14.04.1 | 44.1 | lowlatency, generic |
| 4.4.0-134.160 | 44.1 | generic, lowlatency |
| 4.4.0-134.160~14.04.1 | 44.1 | lowlatency, generic |
| 4.4.0-135.161~14.04.1 | 44.1 | lowlatency, generic |
| 4.15.0-32.35 | 44.1 | lowlatency, generic |
| 4.15.0-32.35~16.04.1 | 44.1 | generic, lowlatency |
| 4.15.0-33.36 | 44.1 | lowlatency, generic |
| 4.15.0-33.36~16.04.1 | 44.1 | lowlatency, generic |
| 4.15.0-34.37 | 44.1 | generic, lowlatency |
| 4.15.0-34.37~16.04.1 | 44.2 | lowlatency, generic |
References:
CVE-2018-3620, CVE-2018-15594, CVE-2018-3646, CVE-2018-6555,
CVE-2018-14633, CVE-2018-15572, CVE-2018-17182
- --
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW7vqaWaOgq3Tt24GAQi5ExAAnlYWTxMnUX1ixmvKjhldFeWRMK02Nt7k
ad3+zDdhTr/lSFB6Mvw210lGvx7K5XmlrgJfHPRkZfbUfMuHsNh2tTM4JaGQ3Qxl
yOfW6niqZRLliHELUs+STjZx2nri9XTImDb8XzT1/F7hEga4Cdy7nHrjbDkAJoS6
l98I1psspn85X1XItUYDnnepNXOupsx5VqfYnqDh31Eb+lRszbmk+DNangczQRWP
/GJTBcYuJyqyByMPLOKRtrH/W4VviyZ5jWpvZXEQIEkUkTO7q9PATejTlG+FaPbH
MArJIu/hiBBOZSQeiTv8t9uDSWaG7dswmFXSynwqNVqtse5pOkuEdorLx5rLxeCI
8QKWEgp8ZLnD1C0DpP7Y/V+vLbq6He35bXAPZ5dOhVqcOiJn8oMWLLtbn07774bR
PMK/tgTx+bbu4ZiFYNPOA6kDozkZTzvGsoZBdXKk6HGfqrYH1F9qT55A8GDvJnhF
3bnsbK72IuuuutI7WIko2AaSOyVMehBxFxLXUBlMVgL7Ty8dhpZE2mhUl1HfzfoR
UdsebOxCOv9D3L/BVVc1/XyrWYyVYyEJMWAP5fl4sF1ERG+4hqgJGarrIIlxQ0Qt
/6Lg7RsniYY3673yRTInWYb7NgVyEYLpLJDjnZv91I32fFS0WKtEP6pF7D2b0pJo
GqOXyV0O8G8=
=vYFD
-----END PGP SIGNATURE-----