Ubuntu 16.04 LTS : linux-hwe, linux-azure vulnerabilities (USN-3695-2)

High Nessus Plugin ID 110895

Synopsis

The remote Ubuntu host is missing one or more security-related
patches.

Description

USN-3695-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu
16.04 LTS.

Wen Xu discovered that the ext4 file system implementation in the
Linux kernel did not properly initialize the crc32c checksum driver. A
local attacker could use this to cause a denial of service (system
crash). (CVE-2018-1094)

It was discovered that the cdrom driver in the Linux kernel contained
an incorrect bounds check. A local attacker could use this to expose
sensitive information (kernel memory). (CVE-2018-10940)

Wen Xu discovered that the ext4 file system implementation in the
Linux kernel did not properly validate xattr sizes. A local attacker
could use this to cause a denial of service (system crash).
(CVE-2018-1095)

Jann Horn discovered that the 32 bit adjtimex() syscall implementation
for 64 bit Linux kernels did not properly initialize memory returned
to user space in some situations. A local attacker could use this to
expose sensitive information (kernel memory). (CVE-2018-11508)

It was discovered that an information leak vulnerability existed in
the floppy driver in the Linux kernel. A local attacker could use this
to expose sensitive information (kernel memory). (CVE-2018-7755).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

Solution

Update the affected packages.

See Also

https://usn.ubuntu.com/3695-2/

Plugin Details

Severity: High

ID: 110895

File Name: ubuntu_USN-3695-2.nasl

Version: 1.3

Type: local

Agent: unix

Published: 2018/07/03

Modified: 2018/12/01

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.1

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C

CVSS v3.0

Base Score: 5.5

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-azure, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-generic, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-generic-lpae, p-cpe:/a:canonical:ubuntu_linux:linux-image-4.15-lowlatency, p-cpe:/a:canonical:ubuntu_linux:linux-image-azure, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-hwe-16.04, p-cpe:/a:canonical:ubuntu_linux:linux-image-generic-lpae-hwe-16.04, p-cpe:/a:canonical:ubuntu_linux:linux-image-lowlatency-hwe-16.04, cpe:/o:canonical:ubuntu_linux:16.04

Patch Publication Date: 2018/07/02

Reference Information

CVE: CVE-2018-1094, CVE-2018-10940, CVE-2018-1095, CVE-2018-11508, CVE-2018-7755

USN: 3695-2