-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2020.2003
               LSN-0068-1: Kernel Live Patch Security Notice
                               10 June 2020

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           linux kernel
Publisher:         Ubuntu
Operating System:  Ubuntu
                   Linux variants
Impact/Access:     Access Privileged Data -- Existing Account
                   Denial of Service      -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2020-12114 CVE-2020-11494 CVE-2020-8649
                   CVE-2020-8648 CVE-2020-8647 CVE-2020-0543

Reference:         ESB-2020.1994
                   ESB-2020.1812
                   ESB-2020.1779.3
                   ESB-2020.1476
                   ESB-2020.0771

Original Bulletin: 
   https://usn.ubuntu.com/lsn/0068-1/

Comment: This advisory references vulnerabilities in the Linux kernel that 
         also affect distributions other than Ubuntu. It is recommended that
         administrators running Linux check for an updated version of the 
         kernel for their system.

- --------------------------BEGIN INCLUDED TEXT--------------------

LSN-0068-1: Kernel Live Patch Security Notice
9 June 2020

Linux kernel vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:

  o Ubuntu 20.04 LTS
  o Ubuntu 18.04 LTS
  o Ubuntu 16.04 LTS
  o Ubuntu 14.04 ESM

Summary

Several security issues were fixed in the kernel.

Software Description

  o linux - Linux kernel
  o linux-aws - Linux kernel for Amazon Web Services (AWS) systems
  o linux-oem - Linux kernel for OEM systems

Special Notice for CVE-2020-0543

On June 9, Intel announced CVE-2020-0543, a CPU hardware issue known as Special
Register Buffer Data Sampling (SRBDS), which could result in data leaks from
random number generation instructions. The issue affects a subset of Intel CPUs
and is mitigated by a CPU microcode update. This is a hardware issue and cannot
be mitigated with a livepatch.

The kernel update associated with the CVE provides the ability to turn the
mitigation on and off and to report the presence of the mitigation in the
microcode, and should be installed with the updated microcode.

To determine if your Intel CPU is affected, consult Intel's list of affected
processors. Note that AMD processors, and architectures other than x86_64, are
not affected by this CVE.

Users affected by this issue should update their kernel and CPU microcode, and
reboot into the new kernel. Users not affected by CVE-2020-0543 may continue to
use livepatch updates without rebooting.

For more information about the CVE and our response, please consult the Ubuntu
SRBDS wiki page.

Details

It was discovered that the virtual terminal implementation in the Linux kernel
did not properly handle resize events. A local attacker could use this to
expose sensitive information. (CVE-2020-8647)

It was discovered that the virtual terminal implementation in the Linux kernel
contained a race condition. A local attacker could possibly use this to cause a
denial of service (system crash) or expose sensitive information.
(CVE-2020-8648)

It was discovered that the virtual terminal implementation in the Linux kernel
did not properly handle resize events. A local attacker could use this to
expose sensitive information. (CVE-2020-8649)

It was discovered that the Serial CAN interface driver in the Linux kernel did
not properly initialize data. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2020-11494)

Piotr Krysiuk discovered that race conditions existed in the file system
implementation in the Linux kernel. A local attacker could use this to cause a
denial of service (system crash). (CVE-2020-12114)

Update instructions

The problem can be corrected by updating your kernel livepatch to the following
versions:

Ubuntu 18.04 LTS
    aws - 68.1
    generic - 68.1
    lowlatency - 68.1
    oem - 68.1
Ubuntu 16.04 LTS
    aws - 68.1
    generic - 67.1
    generic - 68.1
    lowlatency - 67.1
    lowlatency - 68.1
Ubuntu 14.04 ESM
    generic - 66.1
    lowlatency - 66.1

Support Information

Kernels older than the levels listed below do not receive livepatch updates. If
you are running a kernel version earlier than the one listed below, please
upgrade your kernel as soon as possible.

Ubuntu 18.04 LTS
    linux - 4.15.0-69
    linux-aws - 4.15.0-1054
    linux-azure - 5.0.0-1025
    linux-gcp - 5.0.0-1025
    linux-oem - 4.15.0-1063
Ubuntu 20.04 LTS
    linux - 5.4.0-26
    linux-aws - 5.4.0-1009
    linux-azure - 5.4.0-1010
    linux-gcp - 5.4.0-1009
    linux-oem - 5.4.0-26
Ubuntu 16.04 LTS
    linux - 4.4.0-168
    linux-aws - 4.4.0-1098
    linux-azure - 4.15.0-1063
    linux-hwe - 4.15.0-69
Ubuntu 14.04 ESM
    linux-lts-xenial - 4.4.0-168

References

  o CVE-2020-0543
  o CVE-2020-8647
  o CVE-2020-8648
  o CVE-2020-8649
  o CVE-2020-11494
  o CVE-2020-12114

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXuBKPuNLKJtyKPYoAQgnew//du5itrxMtAbxtQ0kAcM08r42XSb1Fv+C
mM/9fX7G6y8OJtGkpG2/O+FgHizvdwinhCG93IUwdOBsUWohxo83YSJp47eqr0qc
MWtenIJBpFJB+hFKqsZpUEtvMcMXbRgcpuGCGf9tq8+HE4xF1dyrnz1d4zKA7tbz
iVeW68P6LWwBrlKuYylTUnMPWppWKVPYyazNrZcbzZ5uF0Jty/JmYcLUyR7ysfZq
/OEftt7H3rMo2YsawWEzVl1yI+VdTz2LKFLizGgdzjezODj78Z3R/sPly67fyaL0
gD2rn9/uZzy3cUlm3uX5NfzJ/vOPopykEL/x9q+Bw6Rdfx0ObP/gFoWM/k6pIrS4
QTO3FoRtuR80fZqpwv6L79zNWHRP9qQ37smZB3w9S0OXWQ68dK1Fom5GSuCJKbDy
YxgkWRdzxVKg3fwnwqGntqSJMNFI02JHmwwSJunO9JM/BbYBJBAydwD8JMa6KdUG
aGOi4A9hSuSNuaCYKa6adpXLdsCdMia45yUAPMsj8utZB9cd60C5iz7S/bv5grxS
pVS6/GZNS13iPVpB8TsxBjmCqHTEPCZz1hqxNDUTg0g72nsyN7b+0UibR/xyO11x
iHYW3STf9kBFIaxjxNIfl1JMfSN1ZUuUwttKmNPfOMTvUosrzAvGV1WDSHnA1V6N
FUsnEkuJcD0=
=bNd3
-----END PGP SIGNATURE-----