09 October 2018
Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2018.3039 Linux kernel vulnerability 9 October 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: linux kernel Publisher: Ubuntu Operating System: Ubuntu Impact/Access: Root Compromise -- Existing Account Access Privileged Data -- Existing Account Denial of Service -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2018-17182 CVE-2018-15594 CVE-2018-15572 CVE-2018-14633 CVE-2018-6555 CVE-2018-3646 CVE-2018-3620 Reference: ASB-2018.0204 ESB-2018.3020 ESB-2018.2974 ESB-2018.2955 ESB-2018.2910 ESB-2018.2770 Original Bulletin: https://lists.ubuntu.com/archives/ubuntu-security-announce/2018-October/004611.html - --------------------------BEGIN INCLUDED TEXT-------------------- ========================================================================== Kernel Live Patch Security Notice 0044-1 October 05, 2018 linux vulnerability ========================================================================== A security issue affects these releases of Ubuntu: | Series | Base kernel | Arch | flavors | |------------------+--------------+----------+------------------| | Ubuntu 14.04 LTS | 4.4.0 | amd64 | generic | | Ubuntu 14.04 LTS | 4.4.0 | amd64 | lowlatency | | Ubuntu 16.04 LTS | 4.15.0 | amd64 | generic | | Ubuntu 16.04 LTS | 4.15.0 | amd64 | lowlatency | | Ubuntu 18.04 LTS | 4.15.0 | amd64 | generic | | Ubuntu 18.04 LTS | 4.15.0 | amd64 | lowlatency | Summary: Several security issues were fixed in the kernel. Note that due to a client issue, this livepatch may report that it failed to load. You can verify that the patch has successfully loaded by looking in /sys/kernel/livepatch for a directory starting with the name "lkp_Ubuntu," followed by your kernel version, and ending with the version number, "44." The next client update should correct this problem. Software Description: - - linux: Linux kernel Details: It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local attacker could use this to expose sensitive information (memory from the kernel or other processes). (CVE-2018-3620) It was discovered that the paravirtualization implementation in the Linux kernel did not properly handle some indirect calls, reducing the effectiveness of Spectre v2 mitigations for paravirtual guests. A local attacker could use this to expose sensitive information. (CVE-2018-15594) It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local attacker in a guest virtual machine could use this to expose sensitive information (memory from other guests or the host OS). (CVE-2018-3646) It was discovered that a use-after-free vulnerability existed in the IRDA implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-6555) It was discovered that a stack-based buffer overflow existed in the iSCSI target implementation of the Linux kernel. A remote attacker could use this to cause a denial of service (system crash). (CVE-2018-14633) It was discovered that microprocessors utilizing speculative execution and prediction of return addresses via Return Stack Buffer (RSB) may allow unauthorized memory reads via sidechannel attacks. An attacker could use this to expose sensitive information. (CVE-2018-15572) Jann Horn discovered that the vmacache subsystem did not properly handle sequence number overflows, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2018-17182) Update instructions: The problem can be corrected by updating your livepatches to the following versions: | Kernel | Version | flavors | |--------------------------+----------+--------------------------| | 4.4.0-133.159 | 44.1 | generic, lowlatency | | 4.4.0-133.159~14.04.1 | 44.1 | lowlatency, generic | | 4.4.0-134.160 | 44.1 | generic, lowlatency | | 4.4.0-134.160~14.04.1 | 44.1 | lowlatency, generic | | 4.4.0-135.161~14.04.1 | 44.1 | lowlatency, generic | | 4.15.0-32.35 | 44.1 | lowlatency, generic | | 4.15.0-32.35~16.04.1 | 44.1 | generic, lowlatency | | 4.15.0-33.36 | 44.1 | lowlatency, generic | | 4.15.0-33.36~16.04.1 | 44.1 | lowlatency, generic | | 4.15.0-34.37 | 44.1 | generic, lowlatency | | 4.15.0-34.37~16.04.1 | 44.2 | lowlatency, generic | References: CVE-2018-3620, CVE-2018-15594, CVE-2018-3646, CVE-2018-6555, CVE-2018-14633, CVE-2018-15572, CVE-2018-17182 - -- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to email@example.com and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: firstname.lastname@example.org Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBW7vqaWaOgq3Tt24GAQi5ExAAnlYWTxMnUX1ixmvKjhldFeWRMK02Nt7k ad3+zDdhTr/lSFB6Mvw210lGvx7K5XmlrgJfHPRkZfbUfMuHsNh2tTM4JaGQ3Qxl yOfW6niqZRLliHELUs+STjZx2nri9XTImDb8XzT1/F7hEga4Cdy7nHrjbDkAJoS6 l98I1psspn85X1XItUYDnnepNXOupsx5VqfYnqDh31Eb+lRszbmk+DNangczQRWP /GJTBcYuJyqyByMPLOKRtrH/W4VviyZ5jWpvZXEQIEkUkTO7q9PATejTlG+FaPbH MArJIu/hiBBOZSQeiTv8t9uDSWaG7dswmFXSynwqNVqtse5pOkuEdorLx5rLxeCI 8QKWEgp8ZLnD1C0DpP7Y/V+vLbq6He35bXAPZ5dOhVqcOiJn8oMWLLtbn07774bR PMK/tgTx+bbu4ZiFYNPOA6kDozkZTzvGsoZBdXKk6HGfqrYH1F9qT55A8GDvJnhF 3bnsbK72IuuuutI7WIko2AaSOyVMehBxFxLXUBlMVgL7Ty8dhpZE2mhUl1HfzfoR UdsebOxCOv9D3L/BVVc1/XyrWYyVYyEJMWAP5fl4sF1ERG+4hqgJGarrIIlxQ0Qt /6Lg7RsniYY3673yRTInWYb7NgVyEYLpLJDjnZv91I32fFS0WKtEP6pF7D2b0pJo GqOXyV0O8G8= =vYFD -----END PGP SIGNATURE-----