Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3821-2)

high Nessus Plugin ID 118972

Synopsis

The remote Ubuntu host is missing one or more security updates.

Description

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3821-2 advisory.

- Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service. (CVE-2018-10880)

- The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because ktime_add_safe is not used. (CVE-2018-13053)

- An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.14. A denial of service (out-of- bounds memory access and BUG) can occur upon encountering an abnormal bitmap size when mounting a crafted f2fs image. (CVE-2018-13096)

- An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in
__del_reloc_root() in fs/btrfs/relocation.c when mounting a crafted btrfs image, related to removing reloc rb_trees when reloc control has not been initialized. (CVE-2018-14609)

- An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory.
(CVE-2018-14617)

- An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a local attacker to exploit racy stack unwinding and leak kernel task stack contents. (CVE-2018-17972)

- arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the KVM_SET_ON_REG ioctl. This is exploitable by attackers who can create virtual machines. An attacker can arbitrarily redirect the hypervisor flow of control (with full register control). An attacker can also cause a denial of service (hypervisor panic) via an illegal exception return. This occurs because of insufficient restrictions on userspace access to the core register file, and because PSTATE.M validation does not prevent unintended execution modes. (CVE-2018-18021)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel package.

See Also

https://ubuntu.com/security/notices/USN-3821-2

Plugin Details

Severity: High

ID: 118972

File Name: ubuntu_USN-3821-2.nasl

Version: 1.11

Type: local

Agent: unix

Published: 11/15/2018

Updated: 1/9/2024

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.0

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 3.8

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2018-17972

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.4

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2018-18021

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-1034-aws, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-generic-lpae, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-powerpc-e500mc, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-powerpc-smp, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-powerpc64-emb, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.4.0-139-powerpc64-smp, cpe:/o:canonical:ubuntu_linux:14.04:-:lts

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/14/2018

Vulnerability Publication Date: 7/2/2018

Reference Information

CVE: CVE-2018-10880, CVE-2018-13053, CVE-2018-13096, CVE-2018-14609, CVE-2018-14617, CVE-2018-17972, CVE-2018-18021

USN: 3821-2